Wp Events Manager
Monthly
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.