CVE-2024-8369 Overview
CVE-2024-8369 affects the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The plugin fails to enforce authorization checks on private and password-protected events. Unauthenticated attackers can view event content that site administrators intended to restrict.
The flaw affects all versions of the plugin up to and including 4.0.4.3. The vulnerability maps to [CWE-862] Missing Authorization. Because exploitation requires no authentication and no user interaction, any WordPress site running a vulnerable EventPrime version exposes protected event data to the public internet.
Critical Impact
Unauthenticated attackers can bypass access controls and read the contents of private or password-protected events, resulting in information disclosure.
Affected Products
- Metagauss EventPrime plugin for WordPress, versions up to and including 4.0.4.3
- WordPress sites using the eventprime-event-calendar-management plugin
- Sites relying on EventPrime private or password-protected event visibility controls
Discovery Timeline
- 2024-09-10 - CVE-2024-8369 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8369
Vulnerability Analysis
The EventPrime plugin exposes event data through WordPress endpoints without validating whether the requesting user has permission to view restricted events. The plugin marks events as private or password-protected but omits the authorization check that would enforce those states when data is served to clients.
An attacker interacts with the plugin over the network and receives content that should require authentication or a valid password. The scope is limited to confidentiality of event data; the vulnerability does not permit modification of records or disruption of the site.
The issue is categorized as Broken Access Control and falls under [CWE-862] Missing Authorization. According to Exploit Prediction Scoring System data, the vulnerability has a low near-term exploitation probability, but scanning for vulnerable WordPress plugins is a routine adversary activity.
Root Cause
The root cause is the absence of a capability or password check in the code paths that serve event data. The plugin trusts the visibility state stored with the event but does not gate response payloads on that state. Private events and password-protected events are therefore returned to any caller.
Attack Vector
Exploitation is remote and unauthenticated. An attacker sends a crafted request to an EventPrime endpoint on a target WordPress site and receives event data that should be restricted. Refer to the Wordfence Vulnerability Report for detailed technical analysis.
No verified public exploit code is available for CVE-2024-8369. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-8369
Indicators of Compromise
- Web server access logs showing repeated requests to EventPrime endpoints from a single external IP address without prior authentication
- Requests referencing event identifiers or slugs that correspond to events flagged as private or password-protected in the WordPress database
- Anomalous traffic patterns targeting /wp-content/plugins/eventprime-event-calendar-management/ paths
Detection Strategies
- Inventory WordPress installations and identify sites running EventPrime at version 4.0.4.3 or earlier
- Review web application firewall (WAF) logs for enumeration patterns against EventPrime endpoints
- Correlate event access requests with the authentication state of the requester to identify unauthorized reads
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized analytics platform for query and correlation
- Alert on bursts of requests to EventPrime endpoints that return HTTP 200 status codes without a valid session cookie
- Monitor plugin version inventory continuously to detect deployments of outdated EventPrime builds
How to Mitigate CVE-2024-8369
Immediate Actions Required
- Update the EventPrime plugin to a version later than 4.0.4.3 that addresses the missing authorization check
- Audit private and password-protected events for sensitivity and rotate any information that may have been exposed
- Review WordPress access logs for prior unauthorized access to restricted events
Patch Information
Upgrade the EventPrime – Events Calendar, Bookings and Tickets plugin to the latest release available from the WordPress Plugin Repository. Verify the installed version through the WordPress admin console after applying the update.
Workarounds
- Disable and remove the EventPrime plugin until an updated version can be installed if patching is not immediately possible
- Restrict access to EventPrime endpoints at the WAF or reverse proxy layer to authenticated users only
- Remove sensitive content from private and password-protected events until the plugin is patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
