Description

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T08:16:45.647Z",
  "pubdate": "2026-08-07T08:16:45.647Z",
  "executiveSummary": "An input validation and payment verification vulnerability exists in the WP Events Manager WordPress plugin before version 2.2.5. This security flaw allows unauthenticated remote attackers to manipulate the payment notification mechanism, bypassing legitimate financial transactions entirely.\nThe vulnerability impacts the integrity of the booking and payment workflow within the WP Events Manager plugin. By failing to validate the authenticity of incoming payment notifications against the merchant account and failing to reconcile the paid amount with the actual booking total, the application accepts arbitrary confirmation requests.\nThe risk implications are severe, as malicious actors can arbitrarily mark any booking—including those belonging to other users—as paid without transferring any funds to the merchant. This leads to unauthorized service access, financial fraud, and potential disruption of event management operations.\nExploitation of this vulnerability requires network access to the target WordPress site and knowledge of the booking identifiers. No prior authentication, user interaction, or privilege level is required, making the attack surface publicly exposed to unauthenticated threat actors.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient validation logic within the payment processing and notification handling mechanism of the WP Events Manager plugin. Specifically, the software lacks mechanisms to verify that incoming payment notifications originate from the legitimate, site-configured merchant account. Furthermore, the application fails to perform a server-side reconciliation to ensure that the payment amount transmitted in the notification matches the precise booking total required for the requested transaction.\nThe vulnerable component is the asynchronous payment notification handler responsible for processing transaction callbacks and updating booking statuses within the database. Affected versions include all instances of the WP Events Manager WordPress plugin prior to version 2.2.5.\nThe authentication and privilege requirements are entirely absent; the endpoint handling payment notifications is exposed over the network to unauthenticated users. Attackers do not require any specific roles, capabilities, or prior session tokens to interact with the vulnerable function.\nThe attack flow proceeds as follows: First, an attacker identifies or enumerates a target booking identifier within the WP Events Manager system, which may belong to the attacker or any other legitimate user. Second, the attacker crafts a malicious HTTP request simulating an incoming payment notification or webhook payload. Because the vulnerable component does not cryptographically or logically verify the origin of the notification against the authorized merchant parameters, the payload is accepted as authentic. Third, the application processes the notification and updates the target booking status to paid, omitting any verification step to match the payload's financial figures against the expected booking total. Finally, the database records the booking as successfully completed and paid, granting the attacker or the specified user unauthorized access to the event booking without any corresponding financial transaction reaching the merchant account."
}