Description
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site-s configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users- bookings.
CVSS 5.3EPSS 0.11399999999999999%Risk 0.54
View source- Published
- 2026-08-07 08:16:45
- Last modified
- 2026-08-07 16:17:22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N