EUVD-2026-49224
GHSA-gcg4-cm23-m66p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReconnaissance to locate target WordPress site
-
ExploitSend crafted request to missing-authorization endpoint
-
ExecutionExploit lack of capability check to invoke restricted function
-
ImpactManipulate event data or disrupt service availability.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of Events Made Easy ≤ 3.1.3. The plugin must be active and the vulnerable endpoint must be reachable (typically unrestricted in default WordPress deployments). |
| Impact | CVSS v3.1 base score 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L indicates easy network exploitation with no privileges or user interaction, but only limited integrity and availability impact. No EPSS score or CISA KEV entry exists, and no public exploit code is mentioned, suggesting no active exploitation at this time. The risk is moderate-attackers can tamper with events or disrupt service, but no data exfiltration is possible. Prioritization depends on the criticality of event data; for most sites, this is a medium-priority patch. |
| Exploit ScenarioDerived | An attacker scans for WordPress sites running the vulnerable Events Made Easy plugin (version ≤ 3.1.3) and sends a crafted HTTP request to the unprotected AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=eme_some_action). Without any authentication, the request executes a restricted function, allowing the attacker to alter event details or trigger a partial disruption, such as deleting or corrupting event records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
RemediationAI
Upgrade the Events Made Easy plugin to a version later than 3.1.3. The exact patched version is not explicitly stated in the advisory, but the Patchstack entry commonly implies a fix in 3.1.4 or later. Immediately download the latest release from the WordPress plugin repository or the vendor’s site. If patching is delayed, disable the plugin until the update can be applied-this removes all event functionality but eliminates the vulnerability. Monitor the vendor’s changelog for confirmation of the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authorization check (CWE-862) in the Events Made Easy WordPress plugin, a PHP-based event management tool. The affected code does not verify user permissions (e.g., via current_user_can()) before executing sensitive actions, typically in an AJAX or REST endpoint. This allows an unauthenticated remote attacker to invoke restricted functions. The CPE string cpe:2.3:a:franky:events_made_easy:*:*:*:*:*:*:*:* confirms the vendor and product scope.
Know when Events Made Easy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible, no privileges required, missing authorization permits limited data modification and service disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Events Made Easy
View allThe Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, u
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privi
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenti
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allow
Stored cross-site scripting in the Events Made Easy WordPress plugin through version 3.3.1 lets an authenticated user wi
Stored cross-site scripting in the Events Made Easy WordPress plugin (all versions up to and including 3.2.22) lets unau
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on sev
Exploit-DB