Description

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:48.887Z",
  "pubdate": "2026-08-06T22:16:48.887Z",
  "executiveSummary": "An input validation vulnerability exists in the Event Booking Manager for WooCommerce (Pro) WordPress plugin affecting versions prior to 5.0.3. The flaw resides in the native, non-WooCommerce checkout functionality, specifically regarding how ticket pricing is processed during transactions. The vulnerability allows unauthenticated remote attackers to manipulate transaction parameters by supplying arbitrary values for ticket prices directly from the client side. Because the server fails to validate or re-derive the configured event price against authoritative backend data, malicious actors can successfully alter the cost of paid event tickets to zero. The primary impact of this flaw is severe financial loss and unauthorized service acquisition, enabling unauthenticated users to obtain completed bookings and valid tickets at no financial cost. Exploitation requires no prior authentication or elevated privileges, relying solely on network accessibility to the targeted WordPress site running the vulnerable plugin version. Risk implications are critical for site operators utilizing the native checkout feature, as automated scripts or malicious users can abuse the mechanism to generate fraudulent bookings at scale without triggering payment gateways.",
  "technicalDetails": "The vulnerability is rooted in an absence of server-side input validation and price recalculation logic within the native checkout workflow of the Event Booking Manager for WooCommerce (Pro) WordPress plugin prior to version 5.0.3. When an end-user initiates a booking for a paid event using the plugin's native checkout system instead of the integrated WooCommerce checkout flow, the application processes the transaction by relying entirely on the financial parameters submitted in the client-side HTTP request.\nSpecifically, the vulnerable component ingests the per-ticket price supplied by the client payload rather than securely querying the database or internal application logic to retrieve the official, administrator-configured price associated with the target event ID. An unauthenticated attacker can exploit this architectural deficiency by intercepting the checkout request using an interception proxy or crafting a bespoke HTTP POST request. By modifying the price parameter within the payload to a value of zero (or any arbitrary nominal amount), the attacker forces the server to process the transaction based on the untrusted input.\nThe attack flow proceeds as follows: First, the attacker selects a paid event and navigates to the booking interface. Second, the attacker initiates the native checkout process while capturing or altering the outgoing HTTP request data containing the ticket pricing variables. Third, the attacker injects the modified pricing parameter into the request and transmits it to the server. Fourth, the vulnerable server-side code accepts the manipulated value without verification, finalizes the order status as completed, and generates valid tickets for the event. Because no authentication or special privileges are required, and the endpoint is exposed over standard web protocols, this flaw presents a significant risk to the integrity of the booking and payment processing subsystems of affected WordPress installations."
}