EUVD-2026-54186
GHSA-655w-h872-387j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
PR:N confirmed by description; I:H reflects complete payment bypass for any booking, not merely partial integrity degradation.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
AnalysisAI
Payment authorization token reuse in Events Made Easy WordPress plugin before 3.1.2 enables unauthenticated financial fraud against event organizers. An attacker exploits an absent binding between payment tokens and booking records to pay minimally for a cheap registration, then apply that valid token to a separate, higher-priced booking - having it marked as fully paid. No public exploit is identified at time of analysis, but CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms the attack requires no authentication and no user interaction, making it trivially accessible to non-technical threat actors targeting paid event registrations.
Technical ContextAI
The vulnerability is a business logic flaw in the payment processing workflow of Events Made Easy, a WordPress plugin for event registration and ticketing management. The root cause is the absence of cryptographic or referential binding between a payment authorization token - issued after completing a legitimate transaction - and the specific booking record that transaction was intended to cover. This allows a token generated for one payment context to be applied against an unrelated record. While no CWE is formally assigned in the NVD record, this pattern aligns with CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control) applied to payment object references. The EUVD entry EUVD-2026-54186 confirms all plugin versions from 0 through 3.1.1 are affected.
RemediationAI
Update the Events Made Easy WordPress plugin to version 3.1.2 or later, which introduces proper binding between payment authorization tokens and their originating booking records. The patch is confirmed available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/76856b3d-8f87-4d66-a22a-d65afa98c4ad/. If immediate patching is not possible, the most effective compensating control is to temporarily disable paid event registrations through the plugin's settings, eliminating the attack surface entirely at the cost of halting revenue collection. As a secondary measure, audit recent booking records for anomalies such as multiple bookings from the same user or IP where only the cheapest transaction shows a completed payment. Network-layer controls (WAF rules, rate limiting) will not mitigate this vulnerability since the exploit operates entirely within the application's legitimate payment flow using valid tokens.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today