# EventPrime <= 4.3.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Ticket and Ticket Category Deletion via Event Submission

- **ID:** WPSEC-2026-1914
- **Plugin:** EventPrime – Events Calendar, Bookings, Tickets & AI (`eventprime-event-calendar-management`), https://wordpress.org/plugins/eventprime-event-calendar-management/
- **Affected versions:** all versions before 4.3.6.1
- **Fixed in:** 4.3.6.1 (Update to 4.3.6.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/eventprime-event-calendar-management
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1914/

## Description

The EventPrime plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'em_ticket_category_delete_ids' and 'em_ticket_individual_delete_ids' parameters of the frontend event submission (ep_save_frontend_event_submission AJAX action) and event save routines in all versions up to, and including, 4.3.6.0, due to missing validation that the ticket or ticket category IDs requested for deletion belong to the event being saved. This makes it possible for authenticated attackers, with subscriber-level access and above who are permitted to submit events (or unauthenticated attackers when anonymous event submission is enabled), to delete the tickets and ticket categories of any other event.

## References

- https://wpsec.com/vuln/WPSEC-2026-1914/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.6.1/
- https://wordpress.org/plugins/eventprime-event-calendar-management/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1914/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.