EUVD-2026-54399
GHSA-6g36-5qr8-2jpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running WP Events Manager
-
DeliveryEnumerate or guess a valid booking ID
-
ExploitCraft forged payment-success POST payload with target booking ID
-
ExecutionSubmit to public payment callback endpoint
-
PersistPlugin marks booking as paid without gateway validation
-
ImpactAttacker obtains confirmed event booking at no cost
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | No authentication is required - the payment callback endpoint is intentionally public so that payment gateway servers can reach it. The only prerequisites are that the WP Events Manager plugin is installed and active on the target WordPress site, and that at least one event type has online payment configured (the vulnerability is limited to paid booking flows; sites using the plugin exclusively for free events are not exposed to this financial fraud vector). Exploitation requires knowledge of a valid booking ID, which may be enumerable or predictable depending on site configuration. The CVSS vector PR:N/UI:N/AC:L confirms no privileges, no user interaction, and no special complexity are needed. The primary limiting factor is the requirement that paid events with active payment integration exist on the target site. |
| Impact | The NVD CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the technical profile accurately but materially understates the real-world financial fraud risk: booking-fraud directly translates to revenue loss and inventory manipulation for event operators, a business impact that CVSS I:L does not fully convey. No EPSS score was provided, so exploitation probability cannot be quantified numerically; however, the existence of a publicly available exploit, combined with an entirely unauthenticated network-accessible attack vector requiring no special conditions, places practical exploitation complexity near zero. The vulnerability is not listed in CISA KEV, so confirmed active exploitation in the wild is unverified at time of analysis. The bounded prevalence of the plugin (a niche WordPress event-booking add-on rather than ubiquitous infrastructure software) limits aggregate exposure, but any individual site running paid events is directly at risk of fraudulent bookings. |
| Exploit ScenarioDerived | An attacker browses a WordPress site running a vulnerable version of WP Events Manager, identifies the public payment callback URL (typically a fixed path or a registered WordPress action hook endpoint), and submits a crafted POST request containing a target booking ID and a fabricated payment-success payload. Because the plugin performs no origin verification or amount matching, it processes the notification as legitimate and updates the booking status to 'paid', granting the attacker a confirmed event seat without any real payment. A publicly available exploit exists that automates this process, requiring only a valid booking ID as input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 07, 2026
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
RemediationAI
The vendor-released fix is WP Events Manager version 2.2.5 or later; update immediately via the WordPress plugin dashboard or by downloading the patched release, as documented at https://wpscan.com/vulnerability/08d4761f-ddc6-48f4-909e-db38438e385e/. As a compensating control while patching, administrators can switch all paid event types to a manual-approval workflow so that bookings require human confirmation before being marked paid - this interrupts legitimate self-service checkout but closes the fraud vector. Alternatively, temporarily disabling the plugin's online payment integration and routing customers to an out-of-band payment process eliminates the vulnerable endpoint entirely, at the cost of checkout convenience. After patching, operators should audit their bookings table for anomalous 'paid' statuses on records with no matching payment gateway transaction, particularly for bookings created after the plugin was first installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the payment callback (IPN - Instant Payment Notification) handler of the WP Events Manager WordPress plugin, CPE cpe:2.3:a:unknown:wp_events_manager:*:*:*:*:*:*:*:*, versions prior to 2.2.5. Payment processors such as PayPal or Stripe typically sign or otherwise authenticate their IPN callbacks using shared secrets or cryptographic signatures; the plugin's handler omits both the origin check (e.g., verifying the request IP or HMAC signature against the merchant's configured gateway) and the amount check (comparing notified payment total against the stored booking cost). No CWE is formally assigned, but the root cause maps conceptually to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-20 (Improper Input Validation). Because WordPress payment/booking plugins frequently expose callback URLs publicly to allow gateway servers to reach them, this endpoint is reachable without any authentication by design - making the missing validation a critical business-logic gap.
Know when Wp Events Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Public unauthenticated callback endpoint requires no privileges or interaction; only integrity impact (fraudulent booking status) with no data disclosure or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wp Events Manager
View allPayment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid ev
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all ve
Exploit-DB