EUVD-2026-54395
GHSA-xm6j-g6w8-55mf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires a low-privilege authenticated account (PR:L per description) and low complexity; impact is fraudulent completed bookings (integrity), with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Articles & Coverage 1
AnalysisAI
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an authenticated WordPress account on the target site - the description states 'any authenticated user,' and on typical WordPress sites the lowest self-service subscriber role suffices; and (2) the site must actually use WP Events Manager's paid-event registration/ticketing feature, since the flaw lies in the price computation for paid bookings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) appears inflated and internally inconsistent with the description: the description explicitly states 'any authenticated user,' which implies PR:L, not the PR:N encoded in the vector - verify with the vendor/WPScan. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a normal WordPress account (self-registration is commonly enabled) on a site running WP Events Manager, then begins checkout for a paid event and tampers with the submitted quantity parameter so the plugin computes a zero or non-positive price. The booking is recorded as completed and paid, granting the attacker a valid ticket/registration without any charge. … |
| Remediation | Vendor-released patch: 2.2.5 - upgrade the WP Events Manager plugin to version 2.2.5 or later, which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WP Events Manager installations to identify which are running versions before 2.2.5, and review event transaction logs for any suspicious free registrations on paid events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Events Manager
View allWP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudul
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all ve
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today