CVE-2026-1657

MEDIUM

EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-1657 has a selected CVSS score of 5.3 (medium); EIP currently links 2 repository PoCs.

Description

The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implementing any authentication, authorization, or nonce verification despite a nonce being created. This makes it possible for unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the ep_upload_file_media endpoint.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 17, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

EventPrime – Events Calendar, Bookings and Tickets

Browse metagauss / EventPrime – Events Calendar, Bookings and Tickets

Default status: unaffected

CVE ListThrough 4.2.8.4affected

Proofs of concept

2

Repository PoCs

GitHubVimash-Dilsara/-CVE-2026-1657Repository PoCby Vimash-Dilsara0Exploit2 files

3.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that checks the version of the EventPrime plugin and, if vulnerable or forced, uploads an arbitrary image file to the target WordPress site via the unauthenticated 'ep_upload_file_media' AJAX endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2026-1657.py) and a README.md file. The script implements a proof-of-concept for CVE-2026-1657, which is an unauthenticated image upload vulnerability in the EventPrime WordPress plugin. The code checks the plugin version, determines if it is vulnerable, and then attempts to upload a user-supplied file to the target WordPress site via the vulnerable AJAX endpoint. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The script performs only the advertised exploit behavior and does not contain any unrelated remote access, credential theft, persistence mechanisms, or hidden payloads.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareWordPressEventPrime plugin
Attack typesunauthenticated file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a user-supplied file to the target server via the vulnerable endpoint, which constitutes exploitation, not just detection. The README explicitly labels it an 'exploit'.

CVE-2026-1657.py:46-77README.md:2

Requirements

  • Target must be running a vulnerable version of the EventPrime plugin (<= 4.2.8.4) or the user must choose to force the upload.CVE-2026-1657.py:35-44CVE-2026-1657.py:100-102
  • Attacker must supply a target URL and a local file path to upload.CVE-2026-1657.py:83-88

Observed behavior

  • Fetches the plugin's readme.txt to extract the stable version tag.CVE-2026-1657.py:19-29
  • Compares the detected version against 4.2.8.4 to determine vulnerability.CVE-2026-1657.py:31-44
  • Sends a POST request to /wp-admin/admin-ajax.php with action=ep_upload_file_media and the supplied file, without any authentication or nonce.CVE-2026-1657.py:46-57
  • Parses the JSON response to confirm success and prints the attachment ID and predicted public URL of the uploaded file.CVE-2026-1657.py:59-69
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Unauthenticated file upload via ep_upload_file_media AJAX endpointThe script directly implements the CVE-2026-1657 vulnerability by sending a POST request with a file to /wp-admin/admin-ajax.php using the action 'ep_upload_file_media'.CVE-2026-1657.py:46-77
Version Check
Checks plugin version against known vulnerable range (<=4.2.8.4)The script attempts to read the readme.txt file to extract the stable tag and compares it to the vulnerable version range.CVE-2026-1657.py:19-44
Review boundaries

What the analysis did not establish

  • Only the Python script and README were provided; no other files from the repository were inspected.
  • The script's actual runtime behavior was not observed; analysis is based solely on static code review.
  • Only the two text files (CVE-2026-1657.py and README.md) were provided; no other files exist in the repository according to the inventory. No binary or non-text files were present to inspect.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubd3kc4rt1/CVE-2026-1657Repository PoCby d3kc4rt10Writeup1 file

4.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing an unauthenticated arbitrary file upload vulnerability (CVE-2026-1657) in the EventPrime WordPress plugin. It details the root cause, provides a curl command as a proof-of-concept example, and discusses remediation.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file documenting CVE-2026-1657. It contains no executable code, no concealed payload, and no instructions for the reader to perform harmful actions. The described PoC is a standard curl command demonstrating the reported vulnerability.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
Languagesmarkdown
Target softwareEventPrime WordPress plugin
Attack typesunrestricted file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a detailed technical analysis of CVE-2026-1657. It includes a curl command as a PoC example, but the primary content is explanatory text describing the vulnerability, its root cause, impact, and remediation. It does not contain executable exploit or scanner code.

README.md:1-77

Requirements

  • Target running a vulnerable version of the EventPrime plugin (<= 4.2.8.1)README.md:6

Observed behavior

  • Describes the vulnerability's root cause: insecure AJAX endpoint registration, missing authorization/nonce checks, and flawed file validation.README.md:17-30
  • Provides a curl command as a proof-of-concept example to upload a file to the vulnerable endpoint.README.md:46-49
  • Discusses business impact including storage exhaustion, media library spam, and potential for further exploitation.README.md:32-35
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation Only
The entire artifact is a README.md file with no source code, scripts, or binaries.No executable behavior can be present; the artifact is purely informational.README.md:1-77
Curl Command
curl -i -F "file=@poc.jpg;filename=poc.jpg" "http://TARGET_SITE/wp-admin/admin-ajax.php?action=ep_upload_file_media"The PoC command uploads a file to a target WordPress site to demonstrate the vulnerability. It does not instruct the reader to download or execute anything locally.README.md:46-49
Review boundaries

What the analysis did not establish

  • Evidence consists of a single README.md file; no executable source code is present.
  • The curl command is provided as an illustrative example within the writeup, not as a standalone functional script.
  • Only one file (README.md) was supplied; no other repository files were inspected.
  • Binary files were flagged as metadata-only and not analyzed, though none were identified in this packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7