PT-2026-66701 · WordPress · Events Made Easy
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Events Made Easy WordPress plugin versions prior to 3.1.4
Description
The plugin fails to verify if a requester is authorized to modify a specific record during unauthenticated data-change requests. It relies solely on a public nonce without implementing per-record tokens or ownership checks, which allows unauthenticated attackers to overwrite the personal data of any person record.
Recommendations
Update the plugin to version 3.1.4 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Events Made Easy