CVE-2026-59557
MediumCVSS 6.5Summary
The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
Risk Assessment
The risk involves potential unauthorized access to sensitive data or functions without authentication, which could lead to data leakage or system takeover.
Recommendation
Immediately update the Events Made Easy plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Events Made Easy
See all- CVE-2026-28162High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
- CVE-2026-75963High
The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.
- CVE-2026-14842Medium
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
- CVE-2026-14843Medium
The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
Original NVD description (English source)
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.