The EventPrime plugin for WordPress suffers from a missing capability check in the calendar_events_delete() function, allowing authenticated users with low privileges (subscriber-level and above) to delete arbitrary posts. This is classified under CWE-862 (Missing Authorization). The vulnerability affects all versions up to and including 3.4.3. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Exploitation of this vulnerability allows authenticated users with subscriber-level access or higher to delete arbitrary posts within the WordPress site using the EventPrime plugin. This results in unauthorized loss of data, affecting the integrity and availability of the affected WordPress content. There is no impact on confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, and monitor for unusual deletion activity. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from the metagauss vendor for a patch or official mitigation.