CVE-2026-14842: Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass
Published Aug 6, 2026
·Updated
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
Affected Software
1 affected component
WordPress Events Made Easy<3.1.2
Event History
Aug 6, 2026
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-14842?
The severity of CVE-2026-14842 is rated as medium with a score of 5.3.
2
How do I fix CVE-2026-14842?
To fix CVE-2026-14842, update the Events Made Easy plugin to version 3.1.2 or later.
3
What type of vulnerability is CVE-2026-14842?
CVE-2026-14842 is an unauthenticated payment bypass vulnerability.
4
What versions are affected by CVE-2026-14842?
CVE-2026-14842 affects all versions of the Events Made Easy plugin prior to 3.1.2.
5
What impact does CVE-2026-14842 have on WordPress sites?
CVE-2026-14842 allows unauthenticated attackers to manipulate payment records, potentially leading to financial loss.