CVE-2026-14205
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WP Events Manager WordPress plugin before version 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Risk Assessment
An attacker can gain access to paid events without paying, leading to financial loss and integrity issues in the booking system.
Recommendation
Update the WP Events Manager plugin to version 2.2.5 or later. Additionally, validate quantity and price server-side.
Original NVD description (English source)
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.