WP Events Manager CVE-2026-14205

Exploitation requires (1) an authenticated WordPress account on the target site - the description states 'any authenticated user,' and on typical WordPress sites the lowest self-service subscriber role suffices; and (2) the site must actually use WP Events Manager's paid-event registration/ticketing feature, since the flaw lies in the price computation for paid bookings. The concrete trigger is submitting an attacker-controlled 'quantity' value during paid-event registration that the plugin fails to validate before computing price. Limiting factors: it cannot be exploited without any authentication (contradicting the PR:N in the published CVSS vector), and it has no effect on sites that offer only free events or do not use this plugin's payment workflow.

The published CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) appears inflated and internally inconsistent with the description: the description explicitly states 'any authenticated user,' which implies PR:L, not the PR:N encoded in the vector - verify with the vendor/WPScan. Likewise, the impact is a fraudulent paid booking (an integrity violation of the plugin's commercial records), not a confidentiality or availability breach, so C:H and A:H are not well supported. Real-world risk signals point lower than the headline score: EPSS is only 0.13% (3rd percentile), the CVE is NOT on CISA KEV, and there is no evidence of active exploitation. That said, publicly available exploit code exists and exploitation is trivial (low complexity, self-registration common on WordPress), so for any site actually selling paid tickets through this plugin the practical fraud risk is meaningful and should be prioritized. For sites not using the paid-event feature, the effective risk is minimal.

An attacker registers a normal WordPress account (self-registration is commonly enabled) on a site running WP Events Manager, then begins checkout for a paid event and tampers with the submitted quantity parameter so the plugin computes a zero or non-positive price. The booking is recorded as completed and paid, granting the attacker a valid ticket/registration without any charge. Because exploit code is publicly available and complexity is low, this can be repeated at scale to defraud the event organizer.