## https://sploitus.com/exploit?id=2D89406D-2812-52B8-8857-37D60C4B3DDC
# CVE-2026-1657: Unauthenticated Arbitrary File Upload in EventPrime Plugin
> **Disclaimer:** This repository is created for **educational purposes and ethical disclosure only**. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems without proper authorization.
## Summary
A **Unauthenticated Arbitrary File Upload** vulnerability was discovered in the **EventPrime** plugin for WordPress (versions //poc.jpg`.
* An administrator visiting the WordPress Media Library will see the uploaded file.
## Remediation
To resolve this vulnerability, developers must:
1. **Restrict Endpoint Access:** Remove the `nopriv` declaration if uploading is by design only for authenticated users.
2. **Implement Capability Checks:** Use `current_user_can('upload_files')` to ensure only authorized privileged users can upload.
3. **Validate Nonces:** Implement `check_ajax_referer()` to prevent CSRF attacks.
4. **Strict File Validation:** Use traditional WordPress image handling functions (like `wp_handle_upload()`) which perform stricter MIME-type and content checks.
## Timeline
* **Date (2026-01-29):** Reported to Wordfence.
* **Date (2026-02-17):** Vulnerability patched / Public disclosure.
## References & Credits
* [Wordfence Vulnerability Database](https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa82ff-0d37-4040-b8fc-84d29534a4b7)
* [CVE-2026-1657 on NVD](https://vulners.com/cve/CVE-2026-1657)
* [EventPrime Plugin on WordPress.org](https://wordpress.org/plugins/eventprime-event-calendar-management/)