CVE-2026-24380: 
WordPress vulnerability analysis and mitigation

CVE-2026-24380 is a Missing Authorization (Broken Access Control) vulnerability in the Metagauss EventPrime WordPress plugin (eventprime-event-calendar-management) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects EventPrime versions up to and including 4.2.8.0, with version 4.2.8.1 containing the fix. The vulnerability was reported on December 29, 2025, published on January 22, 2026, and patched by January 28, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged operations within the event calendar management functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote user. The vulnerability was discovered by researcher Bao from BlueRock and reported through Patchstack's Active VDP program (Patchstack).

Successful exploitation results in unauthorized read access to sensitive or restricted data within the EventPrime plugin (low confidentiality impact), with no direct integrity or availability impact per the CVSS scoring. An unauthenticated attacker could access event management data or functionality that should be restricted to privileged users, potentially exposing attendee information or private event details. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or system-level compromise (Patchstack, Feedly).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack, Feedly).

The vendor Metagauss released a patched version, EventPrime 4.2.8.1, which resolves this vulnerability. All users running EventPrime version 4.2.8.0 or earlier should update immediately to version 4.2.8.1 or later. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. As a temporary measure if patching is not immediately possible, consider restricting access to the EventPrime plugin functionality to trusted users only or disabling the plugin until the update can be applied (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 26 – February 1, 2026, indicating routine tracking by the WordPress security community (Wordfence). The vulnerability received standard coverage from automated CVE tracking platforms and no notable researcher commentary or significant social media discussion beyond routine disclosure channels.