CVE-2024-4665 — EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionall…
Published: 2025-05-15 · CVSS: 6.4 · CVSS 3.1
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7