CVE-2026-14205: WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14205?
CVE-2026-14205 has a risk rating of 62, indicating a significant vulnerability.
How do I fix CVE-2026-14205?
To fix CVE-2026-14205, upgrade the WP Events Manager plugin to version 2.2.5 or later.
What does CVE-2026-14205 allow an attacker to do?
CVE-2026-14205 allows authenticated users to create completed bookings for paid events without payment due to improper validation of the 'qty' parameter.
Which version of WP Events Manager is affected by CVE-2026-14205?
CVE-2026-14205 affects WP Events Manager versions before 2.2.5.
Is CVE-2026-14205 a critical vulnerability?
While CVE-2026-14205 has a high risk rating, whether it is considered critical can depend on the specific use case and impact on operations.