CVE-2026-42687

Name of the Vulnerable Software and Affected Versions EventPrime versions prior to 4.3.2.2

Description The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection. This occurs through the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 4.3.2.1.