CVE-2026-15148

Descripción

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site-s configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users- bookings.