What is the CVSS score of EUVD-2026-70567?

EUVD-2026-70567 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-70567?

Within 24 hours: Audit all WordPress installations for Quick Event Manager plugin version 9.17 or earlier and document business criticality of affected sites. Within 7 days: Deactivate and uninstall the plugin immediately, or if business requirements prohibit removal, implement Web Application Firewall rules blocking unauthenticated POST/PUT requests to event management endpoints, and enable audit logging for all event modifications. Within 30 days: Subscribe to the plugin's security advisories and GitHub repository to monitor for a patched version; upon release, prioritize upgrading all affected sites to the fixed version.

Quick Event Manager EUVD-2026-70567

Q: Which versions of Quick Event Manager are affected by EUVD-2026-70567?

Quick Event Manager WordPress plugin versions 9.17 and earlier suffer from broken access control allowing unauthenticated remote attackers to modify event data without credentials.

| CVE-2026-84847 HIGH

Missing Authorization (CWE-862)

2026-09-03 Patchstack

GHSA-m275-m478-ffm6

WordPress Authentication Bypass Wordpress Plugin Quick Event Manager Brightvesseldev

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site with Quick Event Manager ≤9.17
Exploit

Send unauthenticated HTTP request to unprotected plugin endpoint
Execution

Bypass missing authorization check (CWE-862)
Impact

Perform unauthorized write operations on event data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of Quick Event Manager WordPress plugin ≤9.17. The CVSS vector PR:N/AC:L/UI:N/AV:N confirms no authentication, no user interaction, no special setup, and no elevated network position are required. The primary limiting factor is impact scope: integrity is high but confidentiality and availability are unaffected (C:N/A:N), meaning the attacker can manipulate event data but cannot exfiltrate credentials or cause outages. Exploitation is also bounded to sites that have the plugin installed and activated.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N scores 7.5 (High) and reflects network-reachable, low-complexity, unauthenticated exploitation with high integrity impact but no confidentiality or availability consequence. This means attackers can alter event data but cannot read sensitive data or crash the service. No KEV listing and no POC code are present in the available intelligence, which lowers immediate real-world urgency compared to the raw CVSS score. EPSS data is not provided. The niche deployment footprint of this plugin further limits aggregate exposure. However, for sites actively using Quick Event Manager, the PR:N/AC:L combination makes exploitation trivial once the vulnerable endpoint is identified - unauthenticated integrity writes in WordPress plugins are frequently chained with stored XSS or privilege escalation.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted HTTP POST request to the Quick Event Manager's unprotected WordPress AJAX or REST endpoint, bypassing the missing authorization check to create, modify, or delete event records. Because AC:L and PR:N apply, no prior access or configuration is needed beyond knowing or discovering the vulnerable action name - a trivial step via WordPress plugin source inspection. No POC code has been publicly identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

RemediationAI

Update Quick Event Manager to a version beyond 9.17 by checking the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/quick-event-manager/vulnerability/wordpress-quick-event-manager-plugin-9-17-broken-access-control-vulnerability for the confirmed patched release. If an update is not yet available or cannot be applied immediately, deactivate the plugin as a compensating control - this eliminates the attack surface at the cost of losing event management functionality. Site operators should also review WordPress activity logs for unexpected modifications to event records. Restricting wp-admin and wp-login.php access by IP is a general hardening measure but does not mitigate this specific unauthenticated vector if it targets a public-facing AJAX or REST endpoint.

Affected VersionsENISA

Quick Event Manager n/a ≤9.17

Affected Packages

euvd quick_event_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Quick Event Manager is a WordPress plugin by brightvesseldev (CPE: cpe:2.3:a:brightvesseldev:quick_event_manager:*:*:*:*:*:*:*:*) used for scheduling and displaying events. CWE-862 (Missing Authorization) is the root cause - the plugin exposes at least one action (likely a WordPress AJAX handler or REST API route) that performs privileged operations without verifying whether the requester holds an appropriate WordPress capability (e.g., edit_posts, manage_options). In the WordPress plugin ecosystem this typically manifests as wp_ajax_nopriv_ hooks or unauthenticated REST routes that modify backend data, allowing any HTTP client to trigger write operations that should be restricted to editors or administrators.

Know when Quick Event Manager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 7.5 HIGH

Network-reachable unauthenticated endpoint with no interaction needed; only integrity is impacted as attackers alter event data without reading or disrupting it.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

Executive ViewAI

Why It Matters

Quick Event Manager WordPress plugin versions 9.17 and earlier suffer from broken access control allowing unauthenticated remote attackers to modify event data without credentials. This integrity compromise could enable malicious actors to alter customer-facing events, schedules, and critical operational information, directly impacting business continuity and customer trust. Any WordPress site running this plugin faces immediate risk of unauthorized event tampering.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Uninstall the plugin if operational requirements permit; (2) Deploy WAF rules to restrict event-modification requests to authenticated administrators only; (3) Enable comprehensive logging and real-time alerts for unauthorized modification attempts; (4) Restrict plugin access at the web server level (.htaccess) or via WordPress security hardening plugins; (5) Establish daily integrity checks on critical event data to detect unauthorized changes.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Low

niche WordPress event management plugin, limited enterprise footprint

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.