# Events Made Easy <= 3.2.22 - Unauthenticated Insecure Direct Object Reference to Person Record Modification via Booking, Membership and Task Signup Forms

- **ID:** WPSEC-2026-1110
- **Plugin:** Events Made Easy (`events-made-easy`), https://wordpress.org/plugins/events-made-easy/
- **Affected versions:** all versions before 3.2.23
- **Fixed in:** 3.2.23 (Update to 3.2.23 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-made-easy
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1110/

## Description

The Events Made Easy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the frontend booking, membership and task signup forms in all versions up to, and including, 3.2.22, due to the plugin using any existing person record that matches the submitted name and email (or a submitted person_id on the membership form) without checking whether that person belongs to another WordPress user, and trusting a user-supplied wp_id parameter. This makes it possible for unauthenticated attackers who know a registered user's name and email address to overwrite that user's person record (address, phone, preferences and custom answers), make bookings, memberships or task signups in the name of persons linked to other WordPress accounts, and link person records to arbitrary WordPress user IDs.

## References

- https://wpsec.com/vuln/WPSEC-2026-1110/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.23/
- https://wordpress.org/plugins/events-made-easy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1110/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.