CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
Explanation of Vulnerability in Simple Terms
WP Events Manager versions before 2.2.5 contain an integrity vulnerability accessible over the network without authentication. An attacker can modify data or content on the site, though they cannot read sensitive information or disrupt availability. Update to version 2.2.5 or later to patch this issue.
What an attacker can do
Modify or corrupt event data and site content without authentication.
Potential impact on your site
Event information and related content can be altered by unauthorized parties, potentially affecting event listings and attendee trust.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
