Atomic Edge analysis of CVE-2026-25389:
The EventPrime WordPress plugin versions up to 4.2.8.3 contain an unauthenticated information exposure vulnerability. This flaw allows attackers to extract sensitive user and configuration data without authentication. The vulnerability affects the plugin’s AJAX endpoint handling, specifically through insufficient access controls on certain administrative functions.

Atomic Edge research identifies the root cause in the `ep_ajax_public` function within `/includes/class-ep-ajax.php`. The function processes AJAX requests via the `ep_ajax_public` action hook. The vulnerable code fails to validate user permissions before executing sensitive operations. The diff shows the patched version adds proper capability checks and nonce verification in multiple locations, but the original code allowed unauthenticated access to data retrieval functions.

The exploitation method involves sending a crafted POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `ep_ajax_public`. Attackers can specify various sub-actions through the `sub_action` parameter to retrieve different types of sensitive data. For example, setting `sub_action` to `get_event_data` or `get_booking_details` would expose event information or booking records. The attack requires no authentication or nonce tokens in vulnerable versions.

The patch addresses the vulnerability by implementing multiple security improvements. Key changes include adding `current_user_can` checks before sensitive operations, implementing nonce verification via `check_ajax_referer`, and sanitizing user input more rigorously. The diff shows added capability checks in functions like `ep_save_event_meta_boxes` and `ep_respect_requested_post_status`. The plugin also adds `wp_verify_nonce` validation for AJAX requests that modify data.

Successful exploitation exposes sensitive user information including attendee names, email addresses, booking details, and event configuration data. Attackers can enumerate all event registrations, extract personal identifiable information, and gather system configuration details. This data exposure violates privacy regulations and could facilitate further attacks such as phishing campaigns or account takeover attempts.