critical9.8
CVE-2026-14205
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the …
Impact
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Affected products
| Product | Affected versions |
|---|---|
| WP Events Manager WordPress Plugin | before 2.2.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.