The EventPrime plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) that permits unauthenticated users to access private or password-protected event information. This affects all versions up to 4.0.4.3. The vulnerability is due to the absence of proper authorization checks when accessing event data, allowing unauthorized disclosure of event details. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss only.

An attacker without authentication can view private or password-protected events, leading to unauthorized disclosure of event information. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin or implementing additional access controls at the web server or application level to protect private event data.