{"id":"CVE-2026-118523","title":"EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override","summary":"The EventPrime  WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"EventPrime","affected":["EventPrime < 4.3.6.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T14:01:23.463460Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:19.305Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118523","references":[{"url":"https://wpscan.com/vulnerability/d3cdae3c-79a4-4daf-8fe4-b03cd589beb4/"}],"tags":["cve.org","exploit-available"],"epss":0.00467,"epssPercentile":0.40686,"exploits":{"nuclei":["CVE-2026-118523"],"checkedAt":"2026-11-07T18:07:02.828Z"},"ingestedAt":"2026-11-05T21:36:00.359Z","slug":"CVE-2026-118523","body":"## Overview\n\nThe EventPrime  WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.\n\n## Affected\n\n- `EventPrime < 4.3.6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}