Executive brief
Events Made Easy is a WordPress plugin used to manage event registrations and memberships. A security flaw in the plugin allows unauthorized individuals to modify the personal information of any registered person, such as their name, email address, and phone number. This could lead to data corruption, loss of contact with event attendees, and unauthorized changes to membership records.
Technical details
The Events Made Easy plugin for WordPress fails to perform adequate authorization checks when handling data-change requests via the 'eme_cpi' AJAX action. The application relies solely on a public frontend nonce for validation, which can be easily scraped by any visitor. Because there is no per-record token or ownership verification, an unauthenticated attacker can supply a targeted 'person_id' and overwrite PII (Personally Identifiable Information) including names, emails, and phone numbers. This vulnerability is classified as an Insecure Direct Object Reference (IDOR) and was addressed in version 3.1.4.
Affected products
- Events Made Easy Events Made Easy < 3.1.4
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-31: patched: Fixed in version 3.1.4