CVE-2025-14507 is a CWE-200 vulnerability in the EventPrime plugin for WordPress that exposes sensitive booking data through the REST API to unauthenticated actors. Versions up to and including 4.2.7.0 are affected. The vulnerability allows extraction of personal and payment-related information without authentication. A partial patch was introduced in version 4.2.7.0, but no full remediation or official patch link is provided. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can access sensitive user and booking information, including names, emails, ticket details, payment data, and order keys, potentially leading to privacy violations and data leakage. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Since the vulnerability is only partially patched in version 4.2.7.0 and no official full patch or advisory is provided, users should upgrade to version 4.2.7.0 to benefit from the partial fix. Additionally, administrators should consider disabling the REST API if it is not required to reduce exposure. Monitor vendor channels for updates or full patches addressing this vulnerability. Patch status is not yet fully confirmed—check the vendor advisory for current remediation guidance.