The EventPrime plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the save_frontend_event_submission() function. This flaw permits users with minimal privileges (subscriber-level) to overwrite post titles and content without proper capability checks. The risk extends to unauthenticated attackers if the allow_submission_by_anonymous_user option is active. The vulnerability affects all versions up to and including 3.4.2. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with subscriber-level access can modify the content and titles of arbitrary posts, potentially leading to content tampering or misinformation. If anonymous submissions are allowed, unauthenticated attackers can also exploit this vulnerability. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the allow_submission_by_anonymous_user setting to prevent unauthenticated exploitation. Additionally, restrict subscriber-level permissions or monitor for unauthorized content changes. Avoid granting unnecessary privileges to users.