EUVD-2026-54202
GHSA-3qf4-97w4-w66g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no auth or interaction; integrity impact is low (financial fraud per transaction) with no confidentiality or availability dimension.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.
AnalysisAI
Price manipulation via client-supplied ticket values in Event Booking Manager for WooCommerce (Pro) before 5.0.3 allows unauthenticated attackers to book paid event tickets at arbitrary prices, including free. The plugin's native (non-WooCommerce) checkout flow trusts the per-ticket price submitted by the client rather than re-deriving it from the server-side event configuration - a classic business logic failure. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special preconditions beyond the affected checkout mode being in use.
Technical ContextAI
The vulnerability is rooted in missing server-side price validation during checkout - a pattern closely aligned with CWE-20 (Improper Input Validation) and CWE-807 (Reliance on Untrusted Inputs in a Security Decision), though no CWE is formally assigned. The plugin ships two checkout modes: integration with WooCommerce's own cart/payment pipeline, and a built-in native checkout. Only the native checkout is affected, as it processes the per-ticket price value submitted in the client request without comparing it against the authoritative price stored in the event's server-side configuration. This allows the integrity of the financial transaction to be subverted purely through HTTP request manipulation, with no cryptographic or session-level protection preventing price substitution. Affected product per EUVD-2026-54202: Event Booking Manager for WooCommerce (Pro), all versions from 0 up to and not including 5.0.3.
RemediationAI
Update Event Booking Manager for WooCommerce (Pro) to version 5.0.3 or later; this is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/f07eb346-7f25-4c5b-acda-aeec57d74496/) and EUVD-2026-54202. As an immediate compensating control for sites unable to patch immediately, disabling or restricting access to the plugin's native checkout and routing all transactions exclusively through WooCommerce's checkout pipeline eliminates the vulnerable code path entirely - WooCommerce's own checkout is not affected. Review recent bookings made through the native checkout for anomalously low or zero-price transactions to identify potential abuse. No side effects from switching checkout modes are documented, but organizers should verify their WooCommerce payment gateway configuration is active before disabling the native checkout.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today