Description

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T06:16:54.383Z",
  "pubdate": "2026-08-07T06:16:54.383Z",
  "executiveSummary": "The WP Events Manager WordPress plugin before 2.2.5 suffers from an insufficient input validation vulnerability that enables authenticated attackers to bypass payment mechanisms for paid events. The root of the issue lies in the application's failure to properly validate the requested ticket quantity provided during the event registration process. Instead of verifying the integrity of the transaction and securely calculating the cost server-side based on authorized pricing and validated parameters, the system computes the total price directly from the attacker-controlled quantity parameter.\nThis architectural flaw allows malicious actors with standard authenticated access to manipulate the quantity variable—such as setting it to zero or a negative value, or injecting arbitrary numerical manipulations—resulting in a calculated price of zero or heavily discounted values while still generating a successfully completed booking status.\nThe impact of this vulnerability includes financial loss for event organizers, unauthorized access to paid events, and potential resource exhaustion through fraudulent registrations. Exploitation requires authenticated access to the target WordPress instance, but no specialized privileges beyond standard user registration are necessary. The risk implication is severe for organizations utilizing the plugin for monetization, as it completely undermines the integrity of the e-commerce and ticketing workflow.",
  "technicalDetails": "The vulnerability resides within the event registration and booking component of the WP Events Manager plugin, specifically affecting versions prior to 2.2.5. The vulnerable component fails to enforce strict server-side validation and sanitization on incoming HTTP requests containing registration parameters, specifically the ticket quantity variable supplied by the client.\nDuring the execution of a paid event registration, the application processes the user's input to determine the total cost of the order. Rather than relying on a secure, immutable mapping of event IDs to pricing structures combined with a securely retrieved quantity, the underlying logic accepts the quantity parameter directly from the user-controlled POST or GET request. The application subsequently multiplies this attacker-supplied quantity against the unit price to derive the total transaction amount.\nAn attacker can exploit this behavior by intercepting the registration request using an HTTP proxy or by crafting a custom HTTP request. By modifying the quantity parameter to '0' or manipulating it in a way that forces the mathematical product to zero, the payment gateway or internal booking status handler perceives the total amount due as zero. Consequently, the transaction bypasses payment gateway integration checks or assumes the order is fully paid, resulting in the generation of a completed, confirmed booking record within the database.\nThe attack flow proceeds as follows: First, the authenticated attacker selects a paid event and initiates the registration process. Second, the attacker intercepts the submission request destined for the vulnerable plugin endpoint. Third, the attacker alters the ticket quantity parameter to an arbitrary malicious value. Fourth, the server processes the manipulated input, computes the flawed price, and finalizes the booking without invoking a legitimate financial transaction. Finally, the attacker receives a confirmed registration ticket for the paid event without rendering payment.\nThe prerequisites for successful exploitation include network exposure of the WordPress site, active user authentication (standard subscriber or customer privileges are typically sufficient), and the presence of an affected version of the WP Events Manager plugin (prior to 2.2.5). Post-exploitation impact encompasses unauthorized service consumption, revenue leakage, and database clutter via fraudulent bookings."
}