Medium severity · published Jan 13, 2026
CVE-2025-14507
EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
EventPrime – Events Calendar, Bookings and Tickets · metagauss
through 4.2.7.0 · source: vendor
Affected product
EE
EventPrime – Events Calendar, Bookings and Tickets
metagauss
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14507
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3422587/
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3432454/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve
More from EventPrime – Events Calendar, Bookings and Tickets
7.2
CVE-2026-13441
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
6.5
CVE-2024-1123
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite
6.1
CVE-2024-12024
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
6.1
CVE-2024-9864
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2024-9865
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log