Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Events Manager 2.2.5 Clear all filters
TI-2026-12759 CVE-2026-15148 · GHSA-6g36-5qr8-2jpf

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

Priority MEDIUM 63

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-08-07 Fixed in 2.2.5 CWE-345
TI-2026-12034 CVE-2026-14205 · GHSA-xm6j-g6w8-55mf

WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

Priority HIGH 82

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-07 Fixed in 2.2.5 CWE-287