Events Made Easy <= 3.3.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Event Author Spoofing via 'event_author' Parameter
- ID
- WPSEC-2026-2926
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.3.8
- Remediation
- Update to 3.3.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'event[event_author]' parameter of the frontend event submission form in all versions up to, and including, 3.3.7, due to the submit handler removing the 'event_author' field only for guests and accepting an arbitrary user ID from logged-in submitters. This makes it possible for authenticated attackers with contributor-level access and above (the default frontend submit permission) to create events attributed to other users, such as administrators, who then also become the default contact person for the event.
References
- https://wpsec.com/vuln/WPSEC-2026-2926/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.8/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS