CVE-2026-14842 — Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a…
Published: 2026-08-06 · CVSS: 5.3 · CVSS 3.1
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7