Exploitation Research Plan: CVE-2026-25312 (Missing Authorization in EventPrime)

1. Vulnerability Summary

The EventPrime – Events Calendar, Bookings and Tickets plugin (up to version 4.2.8.3) contains a missing authorization vulnerability. An unauthenticated attacker can perform unauthorized actions—specifically state-changing operations such as dismissing administrative notices—due to the plugin registering an AJAX handler via wp_ajax_nopriv_ without implementing a current_user_can() check.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: ep_dismiss_admin_notice (Inferred from nonce naming)
• Vulnerable Parameter: notice_id
• Authentication: None (Exploitable via wp_ajax_nopriv_)
• Preconditions: The attacker must obtain a valid nonce, which is localized and leaked on pages where the plugin's admin utilities are enqueued.

3. Code Flow

1. In admin/class-eventprime-event-calendar-management-admin.php, the method enqueue_scripts() creates a nonce with the action string 'ep_dismissable_notice_nonce'.
2. This nonce is localized to the JavaScript variable ep_ajax_object under the key nonce.
3. The plugin registers an AJAX handler (likely ep_dismiss_admin_notice) using add_action('wp_ajax_nopriv_ep_dismiss_admin_notice', ...) and add_action('wp_ajax_ep_dismiss_admin_notice', ...).
4. The handler function verifies the nonce using check_ajax_referer('ep_dismissable_notice_nonce', 'nonce') or wp_verify_nonce().
5. Crucially, the handler fails to check if the requester has administrative privileges (e.g., manage_options).
6. An unauthenticated user can provide a valid nonce and a notice_id to modify the site state by dismissing persistent admin notices for all users.

4. Nonce Acquisition Strategy

The nonce is localized in the ep_ajax_object object. While enqueued in the admin class, EventPrime often loads these utilities on the frontend or login pages if certain blocks/shortcodes are present.

1. Identify Trigger: The plugin's scripts are typically enqueued when a calendar or event list is rendered.
2. Create Setup Page:

   wp post create --post_type=page --post_title="Calendar Test" --post_status=publish --post_content='[em_calendar]'
   

3. Navigate and Extract:
   • Navigate to the newly created page.
   • Use browser_eval to extract the nonce:

     window.ep_ajax_object?.nonce
     

5. Exploitation Strategy

Once the nonce is obtained, perform an unauthenticated POST request to trigger the unauthorized action.

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=ep_dismiss_admin_notice&nonce=[EXTRACTED_NONCE]&notice_id=ep_rating_notice
  

  (Note: common notice IDs include ep_rating_notice, ep_welcome_notice, or ep_trial_notice).

6. Test Data Setup

1. Install EventPrime version 4.2.8.3.
2. Ensure at least one admin notice is "visible" (default on fresh install).
3. Create a public page with the [em_calendar] shortcode to facilitate nonce leakage.

7. Expected Results

• HTTP Response: The server should return a successful status code (usually 200 OK) and a body containing 1 or {"success":true}.
• State Change: The targeted notice will be marked as dismissed in the database (typically in the wp_options table), preventing administrators from seeing it.

8. Verification Steps

After the HTTP request, verify the state change using WP-CLI:

# Check the dismissed notices option (name inferred based on plugin patterns)
wp option get ep_dismissed_notices

Alternatively, log in as an administrator and check if the notice (e.g., the rating or welcome notice) has disappeared from the dashboard.

9. Alternative Approaches

If ep_dismiss_admin_notice is not the specific action, investigate other handlers registered in class-eventprime-event-calendar-management-admin.php that use the ep_ajax_object nonce. Possible candidates include:

• ep_fb_load_more_bookings (if nopriv registration exists, check for PII leakage).
• ep_save_event_order (unauthorized modification of event display order).
• Check if the nonce action passed to wp_verify_nonce is -1 (the default), which would allow any valid nonce from the system to be used.