Security Alert Summary
The EventPrime plugin for WordPress contains an unauthenticated image upload vulnerability that affects all versions up to, and including, 4.2.8.4. An AJAX action was registered as publicly accessible (nopriv-enabled) without proper authentication, authorization, or nonce verification, allowing unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the ep_upload_file_media endpoint.
CVE Details
- CVE ID: CVE-2026-1657
- Affected component: EventPrime plugin for WordPress
- Affected versions: all versions up to, and including, 4.2.8.4
- Published: February 17, 2026 at 06:16:18 AM
- Last modified: February 17, 2026 at 06:16:18 AM
- CVSS v3.1: Base score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / Interaction: Privileges Required: NONE; User Interaction: NONE; authentication is not required
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE: CWE-862
Technical Details
According to the CVE description, the vulnerability is caused by the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implementing authentication, authorization, or nonce verification, even though a nonce is created. The exposed endpoint (ep_upload_file_media) accepts image uploads and creates Media Library attachments. Because the action lacks the required checks, unauthenticated requests can upload image files to the site’s uploads directory and add them to the Media Library.
The issue exists due to missing server-side verification of the nonce and absence of any capability or user-check logic tied to the AJAX handler. The behavior is limited to creating media attachments (integrity impact) and does not indicate direct confidentiality or availability impacts in the CVE data.
How This Could Impact Your Website
In a typical small business WordPress site, the site owner and internal staff rely on a trusted Media Library for images used on pages and in communications. An external attacker exploiting this vulnerability could upload images to the uploads directory and add entries to the Media Library. Practical consequences include unwanted or malicious images appearing on the site or being used to host content for social engineering or phishing campaigns that reference the site, and general tampering or cluttering of media assets that affects content integrity and trust.
A realistic scenario: an unauthenticated attacker uploads images that mimic official communications, an external contractor notices the images in the Media Library and uses them in a newsletter, and recipients receive messages that appear to come from the site, increasing the risk of targeted phishing or social engineering. The CVE data indicates integrity impact is limited (LOW) rather than full site takeover.
“If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.”
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE entry does not specify a fixed version).
- Review and reduce unnecessary user roles and capabilities, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and the Media Library for unusual uploads or behavior and review recent changes to media items.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.2.8.1/includes/class-ep-ajax.php#L1659
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.2.8.1/includes/class-eventprime-event-calendar-management.php#L557
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L1659
- https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-event-calendar-management.php#L557
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455239%40eventprime-event-calendar-management%2Ftrunk&old=3452796%40eventprime-event-calendar-management%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa82ff-0d37-4040-b8fc-84d29534a4b7?source=cve
