EventPrime WordPress Plugin Arbitrary Booking Modification Vulnerability

A vulnerability exists in the EventPrime WordPress plugin in versions prior to 3.5.0, where the plugin fails to properly validate user permissions when updating bookings. This flaw allows users to change or cancel bookings made by others. Additionally, the booking update feature does not include a nonce for security.

Impact

Exploitation of this vulnerability could lead to unauthorized users being able to modify or cancel bookings for other users, potentially causing disruption or confusion in event management.

Remediation

Users are advised to update the EventPrime WordPress plugin to version 3.5.0 or later.