What is the CVSS score of CVE-2026-59557?

CVE-2026-59557 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Events Made Easy CVE-2026-59557

EUVD-2026-49224 MEDIUM

Missing Authorization (CWE-862)

2026-07-27 Patchstack

GHSA-gcg4-cm23-m66p

WordPress Authentication Bypass Events Made Easy Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible, no privileges required, missing authorization permits limited data modification and service disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:08 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

AnalysisAI

Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.

Technical ContextAI

The vulnerability is a missing authorization check (CWE-862) in the Events Made Easy WordPress plugin, a PHP-based event management tool. The affected code does not verify user permissions (e.g., via current_user_can()) before executing sensitive actions, typically in an AJAX or REST endpoint. This allows an unauthenticated remote attacker to invoke restricted functions. The CPE string cpe:2.3:a:franky:events_made_easy:*:*:*:*:*:*:*:* confirms the vendor and product scope.

RemediationAI

Upgrade the Events Made Easy plugin to a version later than 3.1.3. The exact patched version is not explicitly stated in the advisory, but the Patchstack entry commonly implies a fix in 3.1.4 or later. Immediately download the latest release from the WordPress plugin repository or the vendor’s site. If patching is delayed, disable the plugin until the update can be applied-this removes all event functionality but eliminates the vulnerability. Monitor the vendor’s changelog for confirmation of the fix.