CVE-2026-14843
Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
| Vendor | unknown |
| Product | events made easy |
| Published | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown events made easy
Be the first to know when new unknown vulnerabilities affecting unknown events made easy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Events Made Easy
0 < 3.1.4
References
Credits
Haitam Lazaar WPScan