Events Made Easy EUVD-2026-51414

No authentication is required - the CVSS vector confirms PR:N (unauthenticated). The plugin must be installed and active on a WordPress site, and the targeted site must have at least one person record stored by the plugin. The public nonce required to craft the request is exposed to any visitor of the WordPress frontend, so there is no meaningful barrier to obtaining it. The attack is limited to overwriting existing person records; it does not provide read access to data (C:N) or deny availability (A:N). Exploitation is constrained to sites running Events Made Easy versions below 3.1.4 - sites already patched to 3.1.4 are not affected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) scores 5.3 (Medium), and the metrics are consistent with the description: network-reachable, low complexity, no authentication, no user interaction required. The impact is limited to Integrity (I:L) - confidentiality and availability are unaffected. Despite the medium CVSS score, real-world risk is elevated by the presence of publicly available exploit code documented by WPScan, which lowers the attacker skill bar to near zero. There is no KEV listing, so mass in-the-wild exploitation is not confirmed. The attack is fully automatable (AC:L/PR:N/UI:N), meaning a single script could enumerate and corrupt registrant records across multiple WordPress sites. No EPSS score was provided in the input; given POC availability and the unauthenticated network vector, opportunistic exploitation against unpatched sites is plausible. The integrity-only impact limits blast radius to data tampering rather than full compromise, but for event organizers, corrupting registrant personal data has real operational and potential GDPR implications.

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint, supplying the public nonce value (obtainable from any page rendering the plugin's frontend) along with an arbitrary target person record ID and overwritten field values. Because the plugin performs no ownership or session check beyond the shared nonce, the server accepts and persists the attacker-supplied data, corrupting the personal information of any event registrant. A publicly available exploit demonstrates this technique, requiring no authentication or special privileges.