CVE-2026-14843— Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
Quick assessment
Affected
Unknown Events Made Easy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Events Made Easy是WordPress基金会的一款事件管理插件。 WordPress Events Made Easy 3.1.4之前版本存在授权问题漏洞，该漏洞源于未验证请求者是否有权修改目标记录，仅依赖公共nonce且无记录令牌或所有权检查，可能导致未授权攻击者覆盖任何人员记录的个人数据。
Possible ATT&CK Techniques 1 AI
T1136.003 · Cloud AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Events Made Easy | < 3.1.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14843
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Events Made Easy 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Events Made Easy是WordPress基金会的一款事件管理插件。 WordPress Events Made Easy 3.1.4之前版本存在授权问题漏洞，该漏洞源于未验证请求者是否有权修改目标记录，仅依赖公共nonce且无记录令牌或所有权检查，可能导致未授权攻击者覆盖任何人员记录的个人数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Events Made Easy | 0 ~ 3.1.4 | - |
|
II. Public POCs for CVE-2026-14843
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14843
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14843 (1)
-
🔗 Events Made Easy < 3.1.4 – Unauthenticated Person Data Modification via IDOR | CVE 2026-14843 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-07-31 · 34 CVEs total
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | |
| CVE-2026-14930 | JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload | |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Supp | |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | |
| CVE-2026-12251 | Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field | |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR | |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST | |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | |
| CVE-2026-14931 | JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure | |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Sett | |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget B | |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Autho | |
| CVE-2026-14919 | ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset | |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR | |
| CVE-2026-12695 | miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret | |
| CVE-2026-13609 | Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Fo | |
| CVE-2026-14333 | Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive | |
| CVE-2026-14929 | JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR | |
| CVE-2026-15048 | GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Events Made Easy
-
CVE-2026-28162
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scri -
CVE-2026-75963
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Loc -
CVE-2026-14842
Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass -
CVE-2026-59557
WordPress Events Made Easy plugin <= 3.1.3 - Broken Access C -
CVE-2023-0404
Events Made Easy <= 2.3.16 - Missing Authorization
Same vendor: Unknown
-
CVE-2026-78146
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_ -
CVE-2026-77695
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest -
CVE-2026-77757
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move v -
CVE-2026-77758
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticate -
CVE-2026-77789
Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer
V. Comments for CVE-2026-14843
No comments yet