CVE-2025-14507: EventPrime WordPress Information Disclosure

CVE-2025-14507 Overview

The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 4.2.7.0. The vulnerability exists within the plugin's REST API implementation, allowing unauthenticated attackers to extract sensitive booking data when the API is enabled by an administrator. This exposure can lead to the disclosure of personal user information including names, email addresses, ticket details, payment information, and order keys.

Critical Impact

Unauthenticated attackers can harvest sensitive customer data including PII, payment details, and booking information from WordPress sites running vulnerable versions of EventPrime with the REST API enabled.

Affected Products

• EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress versions up to and including 4.2.7.0
• WordPress installations with EventPrime REST API enabled
• Sites collecting booking, ticket, and payment information through EventPrime

Discovery Timeline

• January 13, 2026 - CVE-2025-14507 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-14507

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Information Exposure), where the REST API endpoints fail to properly authenticate and authorize requests before returning sensitive booking data. When an administrator enables the EventPrime REST API functionality, the plugin exposes endpoints that return booking records containing personally identifiable information (PII) without requiring authentication.

The vulnerability allows remote attackers to query the REST API endpoints and retrieve comprehensive booking data from the WordPress database. This includes customer names, email addresses, ticket purchase details, payment transaction information, and unique order keys that could be leveraged for further attacks or fraud.

The vulnerability was partially addressed in version 4.2.7.0, indicating that while some remediation was applied, complete protection required additional patches. WordPress changesets #3422587 and #3432454 contain the fixes applied to address this issue.

Root Cause

The root cause of this vulnerability lies in the REST API implementation within class-eventprime-rest-api.php. The API endpoints responsible for returning booking and order data do not implement proper permission callbacks or capability checks. This allows any unauthenticated user to access these endpoints and retrieve sensitive information that should be restricted to authenticated administrators only.

Specifically, the vulnerable code paths can be found at lines 447 and 651 of the REST API class file, where booking data is retrieved and returned without adequate access control verification.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites running the EventPrime plugin with the REST API feature enabled
2. Crafting HTTP requests to the vulnerable REST API endpoints
3. Parsing the JSON responses to extract sensitive booking data including user PII and payment information
4. Using harvested data for identity theft, phishing campaigns, or financial fraud

The vulnerability is exploitable remotely by any attacker who can reach the WordPress REST API endpoints over the network. Since no authentication is required, the attack can be automated at scale against multiple vulnerable WordPress installations.

Detection Methods for CVE-2025-14507

Indicators of Compromise

• Unusual volume of REST API requests to EventPrime booking endpoints from unknown IP addresses
• Multiple sequential requests querying booking or order data endpoints
• Access log entries showing unauthenticated requests to /wp-json/eventprime/ endpoints returning HTTP 200 status codes
• Evidence of data exfiltration through large response payloads from API endpoints

Detection Strategies

• Monitor web server access logs for patterns of unauthenticated REST API requests targeting EventPrime endpoints
• Implement Web Application Firewall (WAF) rules to detect and alert on unusual API query patterns
• Review WordPress authentication logs for missing authentication on sensitive data endpoints
• Deploy endpoint detection solutions to identify potential data harvesting activity

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and responses
• Configure alerts for high-volume API requests from single IP addresses or ranges
• Monitor for unauthorized access attempts to booking-related API endpoints
• Implement rate limiting on REST API endpoints to slow potential data harvesting attacks

How to Mitigate CVE-2025-14507

Immediate Actions Required

• Update the EventPrime plugin to the latest available version that includes the complete security patches
• Disable the EventPrime REST API feature if not actively required for site functionality
• Review access logs to determine if the vulnerability has been exploited against your installation
• Consider notifying affected users if evidence of data exposure is discovered

Patch Information

The vulnerability was partially patched in EventPrime version 4.2.7.0. Security fixes were implemented through WordPress changesets #3422587 and #3432454. Site administrators should update to the latest available version and verify that all security patches have been applied. Detailed vulnerability analysis is available from Wordfence Threat Intelligence.

Workarounds

• Disable the EventPrime REST API feature through the plugin settings until patches can be applied
• Implement Web Application Firewall rules to block unauthenticated access to EventPrime API endpoints
• Restrict REST API access to authenticated users only through WordPress configuration or security plugins
• Consider using IP-based access controls to limit API access to trusted sources

# Example: Block unauthenticated access to EventPrime REST API via .htaccess
# Add to WordPress .htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/eventprime/ [NC]
RewriteCond %{HTTP:Authorization} ^$
RewriteRule .* - [F,L]
</IfModule>