CVE-2026-8608
MediumCVSS 5.3Summary
The Event Monster plugin for managing events in WordPress is vulnerable to insufficient verification of data authenticity in versions up to 2.1.0. The issue arises from the AJAX handler capture_payment() trusting client-supplied payment data without server-side verification.
Risk Assessment
Attackers can forge payment records, mark bookings as Completed, and obtain confirmation emails with valid QR code tickets without making any actual payment, potentially leading to financial losses.
Recommendation
It is recommended to update the plugin to the latest version and implement appropriate server-side payment data verification mechanisms.
Original NVD description (English source)
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.