Events Made Easy <= 3.2.22 - Unauthenticated Insecure Direct Object Reference to Person Record Modification via Booking, Membership and Task Signup Forms
- ID
- WPSEC-2026-1110
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.2.23
- Remediation
- Update to 3.2.23 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the frontend booking, membership and task signup forms in all versions up to, and including, 3.2.22, due to the plugin using any existing person record that matches the submitted name and email (or a submitted person_id on the membership form) without checking whether that person belongs to another WordPress user, and trusting a user-supplied wp_id parameter. This makes it possible for unauthenticated attackers who know a registered user's name and email address to overwrite that user's person record (address, phone, preferences and custom answers), make bookings, memberships or task signups in the name of persons linked to other WordPress accounts, and link person records to arbitrary WordPress user IDs.
References
- https://wpsec.com/vuln/WPSEC-2026-1110/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.23/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS