CVE-2026-14842 MEDIUM

CVE-2026-14842: Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

Vendor Unknown
Product Events Made Easy
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.

Explanation of Vulnerability in Simple Terms

02Summary

Events Made Easy versions before 3.1.2 contain an integrity vulnerability accessible over the network without authentication or user interaction. An attacker can modify data or content on the site, though they cannot read sensitive information or disrupt availability. Update to version 3.1.2 or later to patch this issue.

What an attacker can do

03Attacker Capabilities

Modify or corrupt data on the site without needing to log in.

Potential impact on your site

04Site Impact

Unauthorized changes to event data, content, or configuration could occur without warning.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published