CVE-2024-1321 is a medium severity vulnerability in the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin (up to version 3.4.2). The issue arises because the plugin permits unauthenticated users to modify the status of order payments, effectively bypassing payment controls. This is due to insufficient verification of data authenticity (CWE-345). The vulnerability allows attackers to book events for free by manipulating payment status without authentication. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges or user interaction required. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker can exploit this vulnerability to bypass payment mechanisms in the EventPrime plugin, allowing unauthorized free bookings of events. This impacts the integrity of the payment process and can lead to financial loss for event organizers. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to order payment status update functionality if possible. Monitor vendor channels for updates and apply patches promptly once available.