EUVD-2026-51414
GHSA-fw4x-rfrx-9g6f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable with no auth (PR:N) and no complexity; integrity-only impact as attackers overwrite but cannot read data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
AnalysisAI
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
Events Made Easy is a WordPress plugin for managing events and registrant data. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin issues a public nonce to gate data-change requests, but this nonce is not scoped to a specific record or tied to an authenticated session or ownership token. Any party who can observe or derive the public nonce - including unauthenticated visitors - can replay it against arbitrary person records. The affected CPE is cpe:2.3:a:unknown:events_made_easy:*:*:*:*:*:*:*:* covering all versions up to but not including 3.1.4. This is a classic Broken Object Level Authorization (BOLA/IDOR) pattern where the authorization check verifies the nonce exists but never verifies whether the requester owns or is permitted to modify the target record.
RemediationAI
Update the Events Made Easy WordPress plugin to version 3.1.4 or later, which is the vendor-released patch addressing this authorization bypass. Plugin updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI using 'wp plugin update events-made-easy'. If immediate patching is not feasible, a compensating control is to restrict access to the plugin's data-change endpoints at the web server or WAF layer by blocking unauthenticated POST requests to the affected AJAX action handlers - though this may break legitimate unauthenticated event registration flows depending on site configuration. Alternatively, temporarily deactivating the plugin eliminates exposure entirely but also disables event management functionality. The WPScan advisory at https://wpscan.com/vulnerability/0b445129-19e2-4240-a79a-d3190161d369/ provides additional guidance.
More in Events Made Easy
View allThe Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privi
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenti
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allow
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote at
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on sev
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today