Description
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site-s configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users- bookings.
CVSS 5.3EPSS 0.11399999999999999%Risque 0.54
Voir la source- Publication
- 2026-08-07 08:16:45
- Dernière modification
- 2026-08-07 16:17:22
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N