CVE-2026-14842
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
Risk Assessment
Attackers can manipulate payments to avoid full payment for more expensive bookings, leading to financial losses.
Recommendation
Update the Events Made Easy plugin to version 3.1.2 or later to ensure payment token binding to the specific booking.
Other vulnerabilities in Events Made Easy
See all- CVE-2026-28162High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
- CVE-2026-59557Medium
The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
- CVE-2026-75963High
The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.
- CVE-2026-14843Medium
The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
Original NVD description (English source)
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.