medium5.3
CVE-2026-14842
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated …
Impact
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
Affected products
| Product | Affected versions |
|---|---|
| Events Made Easy WordPress Plugin | before 3.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.