CVE-2026-14205
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The WP Events Manager WordPress plugin before version 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Risk Assessment
An attacker can gain access to paid events without paying, leading to financial loss and integrity issues in the booking system.
Recommendation
Update the WP Events Manager plugin to version 2.2.5 or later. Additionally, validate quantity and price server-side.
Original NVD description (English source)
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.