CVE-2025-69358: 
WordPress vulnerability analysis and mitigation

CVE-2025-69358 is a Missing Authorization (Broken Access Control) vulnerability in the Metagauss EventPrime WordPress plugin (event calendar management). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all versions up to and including 4.2.6.0. The vulnerability was reported on December 11, 2025, by researcher Nguyen Ba Khanh and published by Patchstack on March 10, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to perform adequate authorization checks on one or more functions, allowing unauthenticated users to invoke actions that should be restricted to privileged roles. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable remotely. The flaw falls under OWASP Top 10 category A1: Broken Access Control, where missing nonce token or capability checks permit unprivileged users to execute higher-privileged operations within the event calendar management functionality (Patchstack).

Successful exploitation allows unauthenticated attackers to perform unauthorized write or modification actions against event calendar data, resulting in a high integrity impact with no confidentiality or availability impact per the CVSS scoring. Attackers could manipulate, create, or delete events and calendar entries on affected WordPress sites without any credentials. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

The vulnerability requires no authentication and no user interaction, making it highly accessible to automated exploitation. Patchstack classifies it as high priority and notes it is expected to be exploited in mass-exploit campaigns. The EPSS score is approximately 0.017% (0.000170), indicating a currently low but non-zero probability of exploitation in the near term. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported, and it does not appear in the CISA KEV catalog at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the EventPrime plugin (versions ≤ 4.2.6.0) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/eventprime-event-calendar-management).
2. Identify unprotected endpoints: Enumerate the plugin's AJAX actions or REST API endpoints that lack proper authorization checks — these are the functions missing capability or nonce validation.
3. Craft unauthorized request: Send an unauthenticated HTTP POST or GET request directly to the vulnerable endpoint (e.g., WordPress admin-ajax.php with the relevant action parameter, or a REST API route), bypassing any expected authentication.
4. Execute privileged action: The server processes the request without verifying the caller's identity or permissions, allowing the attacker to create, modify, or delete event calendar data as if they were an authorized administrator.
5. Achieve objective: Depending on the exposed functionality, the attacker may deface event listings, inject malicious content into calendar entries, or disrupt event management operations on the target site (Patchstack).

• Network: Unauthenticated POST requests to wp-admin/admin-ajax.php or EventPrime REST API endpoints with EventPrime-specific action parameters from unknown or automated IP addresses; high-volume repeated requests to these endpoints suggesting automated scanning.
• Logs: WordPress access logs showing requests to EventPrime plugin endpoints without valid authentication cookies or nonce tokens; unexpected modifications to event records in the WordPress database (wp_posts or custom EventPrime tables) with no corresponding authenticated user session.
• File System: Unexpected changes to event or calendar content that cannot be attributed to a logged-in administrator in WordPress audit logs.
• Application: Unexplained creation, modification, or deletion of events in the EventPrime calendar dashboard not associated with any known user action (Patchstack).

The vendor has released a patched version: EventPrime 4.2.7.0, which resolves the missing authorization issue. All users running version 4.2.6.0 or earlier should update immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks both legitimate and illegitimate exploitation attempts until the plugin is updated; enabling auto-update for vulnerable plugins is also recommended. If immediate updating is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

Patchstack, which coordinated the disclosure, classified the vulnerability as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. The vulnerability was reported through Patchstack's Active VDP (Vulnerability Disclosure Program) by researcher Nguyen Ba Khanh. No significant broader media coverage or notable social media commentary beyond standard vulnerability database listings has been identified (Patchstack).