EUVD-2026-54399
GHSA-6g36-5qr8-2jpf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Public unauthenticated callback endpoint requires no privileges or interaction; only integrity impact (fraudulent booking status) with no data disclosure or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
AnalysisAI
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the payment callback endpoint is intentionally public so that payment gateway servers can reach it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the technical profile accurately but materially understates the real-world financial fraud risk: booking-fraud directly translates to revenue loss and inventory manipulation for event operators, a business impact that CVSS I:L does not fully convey. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses a WordPress site running a vulnerable version of WP Events Manager, identifies the public payment callback URL (typically a fixed path or a registered WordPress action hook endpoint), and submits a crafted POST request containing a target booking ID and a fabricated payment-success payload. Because the plugin performs no origin verification or amount matching, it processes the notification as legitimate and updates the booking status to 'paid', granting the attacker a confirmed event seat without any real payment. … |
| Remediation | The vendor-released fix is WP Events Manager version 2.2.5 or later; update immediately via the WordPress plugin dashboard or by downloading the patched release, as documented at https://wpscan.com/vulnerability/08d4761f-ddc6-48f4-909e-db38438e385e/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Events Manager
View allPayment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid ev
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all ve
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today