Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

EventPrime Plugin for WordPress Lets Unpaid Events Be Booked

CVE-2024-1321 · published 2 years ago
Summary

The EventPrime plugin for WordPress allows anyone to book events without paying. This means that anyone can book events without paying for them. To fix this, update the plugin to the latest version.

What to do
  • Update metagauss eventprime to version 3.4.3 or later.
Affected software
VendorProductAffected versions
metagauss eventprime < 3.4.3
cpe:2.3:a:metagauss:eventprime:*:*:*:*:*:wordpress:*:*
Original advisory text
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthent...
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published13 Mar 2024
Updated4 Nov 2026
First seen12 Mar 2026
Sources
CVE-2024-1321 · OSV
CVE-2024-1321 · NVD
Track software like this
Free during beta