CVE-2025-14507

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14507", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-11T00:38:29.878Z", "datePublished": "2026-01-13T13:49:13.254Z", "dateUpdated": "2026-04-08T16:50:55.999Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:55.999Z"}, "affected": [{"vendor": "metagauss", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0."}], "title": "EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422587/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3432454/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "timeline": [{"time": "2025-12-11T00:55:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:11:19.981342Z", "id": "CVE-2025-14507", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:11:27.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14507", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:11:19.981342Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:11:23.785Z"}}], "cna": {"title": "EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API", "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "metagauss", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T00:55:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422587/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3432454/"}], "descriptions": [{"lang": "en", "value": "The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:55.999Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14507", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:55.999Z", "dateReserved": "2025-12-11T00:38:29.878Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-13T13:49:13.254Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "vendor": "metagauss", "versions": [{"lessThanOrEqual": "4.2.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0."}, {"lang": "es", "value": "El plugin EventPrime - Events Calendar, Bookings and Tickets para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta, e incluyendo, la 4.2.7.0 a trav\u00e9s de la API REST. Esto hace posible que atacantes no autenticados extraigan datos sensibles de reserva, incluyendo nombres de usuario, direcciones de correo electr\u00f3nico, detalles de los tickets, informaci\u00f3n de pago y claves de pedido cuando la API est\u00e1 habilitada por un administrador. La vulnerabilidad fue parcheada parcialmente en la versi\u00f3n 4.2.7.0."}], "id": "CVE-2025-14507", "lastModified": "2026-06-17T08:36:02.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14507", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:11:19.981342Z", "version": "2.0.3"}}]}, "published": "2026-01-13T14:16:37.570", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3422587/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3432454/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:27:29.002621+00:00", "value": {"mitigation_remediation": ["Upgrade the EventPrime plugin to version 4.2.7.0 or later to apply the available patch.", "If the REST API is not required, disable the EventPrime REST API endpoint through the plugin settings or WordPress configuration to eliminate the exposure vector.", "Monitor site logs for unauthorized REST API activity and consider implementing rate limiting or WAF rules to reduce the likelihood of successful exploitation."], "summary": {"action": "Apply Update", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the EventPrime \u2013 Events Calendar, Bookings and Tickets plugin by metagauss, specifically all versions up to and including 4.2.7.0. It applies only when the REST API endpoint is enabled, a setting that can be configured by site administrators.", "description_and_impact": "The EventPrime plugin for WordPress can expose sensitive booking data\u2014including user names, email addresses, ticket details, payment information, and order keys\u2014through its REST API. When the API is enabled by an administrator, any unauthenticated user can retrieve this information, compromising the confidentiality of event participants and transactions. The flaw represents a common information leakage weakness, classified as CWE-200.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation at present. The issue is not listed in CISA\u2019s KEV catalog. Attackers can gain unauthenticated access via the exposed REST API, potentially from any network location with internet reach to the site. The overall risk is moderate, primarily driven by the potential for widespread data exposure if the API remains enabled."}}}}, "created": "2026-01-14T11:09:17.355836+00:00", "updated": "2026-04-21T16:30:40.684380+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$eventprime", "wordpress", "wordpress$PRODUCT$wordpress"]}