CVE-2026-15148

Name of the Vulnerable Software and Affected Versions WP Events Manager versions prior to 2.2.5

Description The plugin fails to verify if incoming payment notifications originate from the configured merchant account and does not check if the paid amount matches the booking total. This allows unauthenticated users to mark any booking, including those belonging to other users, as paid without a legitimate transaction occurring.

Recommendations Update to version 2.2.5 or later.