EventPrime WordPress Plugin Unauthenticated Arbitrary File Upload — CVE-2026-1657

Metadata

Affected Target

Summary

The EventPrime WordPress plugin registers an AJAX action ep_upload_file_media with nopriv support, meaning any unauthenticated visitor can reach it. The handler upload_file_media() in includes/class-ep-ajax.php neither checks a user capability (current_user_can()) nor verifies a security nonce, and it only inspects the client-supplied filename extension rather than validating actual file content. This lets an unauthenticated attacker upload arbitrary files into the WordPress uploads directory and create Media Library attachment records, which can be used for storage-exhaustion denial of service, spamming the media library, or as a stepping stone toward further compromise if combined with other flaws. The repo documents the flaw with root-cause file/line references and a working curl-based reproduction rather than a packaged exploit script.

Vulnerability Details

Root Cause

includes/class-eventprime-event-calendar-management.php (around line 557) registers the upload_file_media action with nopriv support enabled, and the handler upload_file_media() in includes/class-ep-ajax.php (lines 1659-1697) lacks both authorization/nonce checks and real server-side content validation, checking only the client-provided filename extension before calling move_uploaded_file().

Attack Vector

1. Attacker prepares a file (optionally disguised with an image-like extension).
2. Attacker sends an unauthenticated multipart POST to /wp-admin/admin-ajax.php?action=ep_upload_file_media with the file attached.
3. The plugin saves the file directly into wp_upload_dir()['path'] and creates a WordPress attachment via wp_insert_attachment().
4. The response confirms success with the new attachment ID, and the file becomes retrievable from the uploads path.

Impact

Unauthenticated attackers can fill server storage, pollute the Media Library, or lay groundwork for further exploitation (e.g., RCE if paired with an execution-enabling misconfiguration or LFI).

Environment / Lab Setup

Target:   WordPress site with EventPrime plugin <= 4.2.8.1
Attacker: curl (or any HTTP client capable of multipart/form-data POST)

Proof of Concept

PoC Script

No standalone script is provided in the source repository; the PoC is a single documented curl request (see README.md reasoning above and the command below).

1
2
3

curl -i \
  -F "file=@poc.jpg;filename=poc.jpg" \
  "http://TARGET_SITE/wp-admin/admin-ajax.php?action=ep_upload_file_media"

Sending this request with no session cookies causes the target to store poc.jpg under wp-content/uploads/<year>/<month>/ and return a JSON body containing the new attachment_id, confirming the unauthenticated upload succeeded.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected attachments in the Media Library with no corresponding admin upload activity
• Rapid growth in wp-content/uploads/ disk usage without matching legitimate content
• Repeated unauthenticated POSTs to the ep_upload_file_media action

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/d3kc4rt1/CVE-2026-1657 on 2026-07-05.