Description
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
CVSS 5.3EPSS 0.291%Risk 0.54
View source- Published
- 2026-08-06 22:16:47
- Last modified
- 2026-08-07 14:16:56
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N