CVE-2026-1657: EventPrime WordPress Auth Bypass Vulnerability

CVE-2026-1657 Overview

The EventPrime Event Calendar Management plugin for WordPress contains an unauthorized file upload vulnerability that allows unauthenticated attackers to upload image files to the WordPress uploads directory. The vulnerability exists because the upload_file_media AJAX action is registered as publicly accessible (nopriv-enabled) without implementing authentication, authorization, or nonce verification—despite a nonce being created in the code.

This broken access control flaw (CWE-862: Missing Authorization) enables attackers to bypass security controls and upload images directly to the Media Library via the ep_upload_file_media endpoint, potentially leading to storage abuse, malicious content hosting, or serving as a stepping stone for more sophisticated attacks.

Critical Impact

Unauthenticated attackers can upload image files to WordPress sites running vulnerable versions of EventPrime, creating Media Library attachments without any authentication or authorization checks.

Affected Products

• EventPrime Event Calendar Management Plugin for WordPress versions up to and including 4.2.8.4

Discovery Timeline

• 2026-02-17 - CVE-2026-1657 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1657

Vulnerability Analysis

The vulnerability resides in the EventPrime plugin's AJAX handler implementation, specifically within the class-ep-ajax.php file. The plugin registers the upload_file_media AJAX action with WordPress's wp_ajax_nopriv_ hook, which allows the endpoint to be accessed by unauthenticated users. While the developers created a nonce for security validation, they failed to actually verify it before processing file uploads.

This architectural oversight means any external user can craft HTTP requests to the ep_upload_file_media endpoint and successfully upload image files to the WordPress uploads directory. The uploaded files are then registered as Media Library attachments, giving them persistence within the WordPress installation.

The impact allows attackers to abuse server storage resources, potentially host phishing content or malicious images, and in certain configurations, this could be chained with other vulnerabilities to achieve more severe outcomes.

Root Cause

The root cause is a Missing Authorization vulnerability (CWE-862) where the plugin registers a privileged file upload action with the wp_ajax_nopriv_ hook without implementing proper authentication checks. Although nonce generation code exists in class-eventprime-event-calendar-management.php, the actual nonce verification step was never implemented in the AJAX handler, rendering the security measure ineffective.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker can directly target the vulnerable AJAX endpoint by sending a crafted HTTP POST request to the WordPress site's admin-ajax.php with the action parameter set to ep_upload_file_media. The request includes an image file as multipart form data.

Since no authentication or nonce verification occurs, the server processes the upload request and stores the image in the WordPress uploads directory. The attacker receives confirmation of the successful upload along with attachment details.

The attack flow involves:

1. Identifying a WordPress site running a vulnerable version of EventPrime
2. Crafting a POST request to /wp-admin/admin-ajax.php?action=ep_upload_file_media
3. Including an image file in the multipart form data
4. The server processes the request without authentication and creates a Media Library attachment

Detection Methods for CVE-2026-1657

Indicators of Compromise

• Unexpected image files appearing in the WordPress uploads directory without corresponding user activity
• Unusual Media Library attachments created by anonymous or unexpected users
• HTTP POST requests to admin-ajax.php with action parameter ep_upload_file_media from unauthenticated sources
• Spike in file upload activity or storage consumption without legitimate user actions

Detection Strategies

• Monitor web server access logs for POST requests to admin-ajax.php containing the ep_upload_file_media action from unauthenticated sessions
• Implement WordPress file integrity monitoring to detect unauthorized additions to the uploads directory
• Review Media Library for attachments created without corresponding authenticated user sessions
• Deploy web application firewall (WAF) rules to detect and block unauthorized AJAX file upload attempts

Monitoring Recommendations

• Enable verbose logging for AJAX requests in WordPress and monitor for ep_upload_file_media activity
• Set up alerts for unusual patterns of file uploads, particularly from IP addresses not associated with authenticated users
• Implement storage quota monitoring to detect rapid consumption that may indicate abuse
• Regularly audit Media Library contents against expected legitimate uploads

How to Mitigate CVE-2026-1657

Immediate Actions Required

• Update the EventPrime Event Calendar Management plugin to a version newer than 4.2.8.4 immediately
• Review Media Library for any suspicious image uploads that may have occurred during the exposure window
• Temporarily disable the EventPrime plugin if an immediate update is not possible
• Implement WAF rules to block unauthenticated requests to the ep_upload_file_media AJAX endpoint

Patch Information

The vulnerability has been addressed in versions released after 4.2.8.4. The patch implements proper nonce verification and authentication checks before processing file upload requests. Review the WordPress Changeset 3455239 for detailed code changes. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict access to admin-ajax.php for the specific action using server-level configuration (Apache/Nginx rules)
• Deploy a WordPress security plugin with firewall capabilities to block unauthorized AJAX requests
• Temporarily disable the EventPrime plugin until the patch can be applied
• Implement network-level controls to limit access to WordPress admin endpoints from trusted IP ranges only

# Nginx configuration to block unauthenticated access to the vulnerable endpoint
location /wp-admin/admin-ajax.php {
    # Block specific action parameter for unauthenticated users
    if ($arg_action = "ep_upload_file_media") {
        return 403;
    }
}