Security Alert Summary
The EventPrime – Events Calendar, Bookings and Tickets WordPress plugin contains a sensitive information exposure vulnerability in its REST API. Unauthenticated attackers can extract booking-related data — including user names, email addresses, ticket details, payment information, and order keys — when the API is enabled by an administrator. The CVE entry indicates the issue affects all versions up to and including 4.2.7.0 and that version 4.2.7.0 was partially patched.
CVE Details
- CVE ID: CVE-2025-14507
- Affected component: EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress (REST API)
- Affected versions: All versions up to, and including, 4.2.7.0 (per the CVE description). The entry notes a partial patch in 4.2.7.0; a fully fixed version is not specified in the CVE entry.
- Published: January 13, 2026 at 2:16:37 PM UTC
- Last modified: January 13, 2026 at 2:16:37 PM UTC
- CVSS v3.1: Base Score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / Privileges / User interaction: No privileges required (PR:N). No user interaction required (UI:N). The vulnerability can be exploited by unauthenticated attackers when the REST API is enabled.
- Primary impact: Confidentiality — LOW; Integrity — NONE; Availability — NONE
- Weakness (CWE): CWE-200 (Exposure of Sensitive Information)
Technical Details
The CVE description identifies a Sensitive Information Exposure via the plugin’s REST API implementation. When the plugin’s API is enabled by an administrator, endpoints exposed by the EventPrime REST API can return booking and order-related data to unauthenticated requests. The information enumerated in the CVE includes user names, email addresses, ticket details, payment information, and order keys.
The public references include the plugin REST API implementation file (class-eventprime-rest-api.php) and specific line references, indicating the issue is in the plugin’s REST API handling. The CVE notes a partial patch applied in 4.2.7.0 but does not specify a complete remediation in a later version.
Impact is limited to disclosure of sensitive booking/order data exposed via the API. There is no CVE-specified indication of data modification, service disruption, or privilege escalation resulting from this vulnerability.
How This Could Impact Your Website
Consider a site where an administrator enables the EventPrime REST API to integrate with external services. An unauthenticated attacker scanning the site could query the exposed endpoints and retrieve booking records that include customer names, email addresses, ticket details, payment information, and order keys. In a small organization this could expose internal staff or customer emails used for bookings; for larger sites it could expose many customer records.
Realistic consequences include targeted phishing or social engineering against customers or staff using the exposed email addresses and order details, or leakage of order/payment metadata that could be useful to fraudsters. The CVE impact is primarily data exposure (confidentiality), not site takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- If you have the plugin installed and the REST API is not required, disable the plugin’s API features or the plugin until a fix is confirmed.
- Review and reduce unnecessary user roles and plugin permissions, especially for contributors and other non-administrative roles.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual access patterns or requests to REST API endpoints that should not be public.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651
- https://plugins.trac.wordpress.org/changeset/3422587/
- https://plugins.trac.wordpress.org/changeset/3432454/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve
