CVE-2026-14205 is an improper authentication vulnerability (CWE-287) in the WP Events Manager WordPress plugin prior to version 2.2.5. The plugin fails to validate the requested quantity during paid event registration, allowing an authenticated user to specify an arbitrary quantity. Because the price calculation relies on this unvalidated quantity, an attacker can create completed bookings without making any payment. This vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with any authenticated user privileges can bypass payment requirements for paid events by manipulating the quantity parameter. This leads to unauthorized free bookings, potentially causing financial loss to event organizers and undermining the integrity of the event registration system. The vulnerability affects confidentiality, integrity, and availability of the booking process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to trusted users only and monitor event registrations for suspicious activity. Avoid using affected versions of the plugin in production environments if possible.