CVE-2026-14842 describes an authorization bypass vulnerability in the Events Made Easy WordPress plugin prior to version 3.1.2. The plugin fails to bind the payment authorization token to the specific payment record being charged. As a result, an unauthenticated attacker can exploit this flaw by submitting a payment authorization token for a low-cost booking and have a different, more expensive booking marked as paid. This vulnerability is categorized under CWE-639, which involves authorization bypass through user-controlled keys. No official patch or remediation level has been provided in the available data.

The vulnerability allows attackers to bypass payment authorization controls, potentially enabling them to pay less than the required amount for expensive bookings. This can lead to financial loss for the service provider as unauthorized payments are accepted and higher-priced bookings are marked as paid without proper authorization. There is no indication of confidentiality or availability impact. The CVSS score of 5.3 reflects a medium severity primarily due to integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting or monitoring payment authorization processes and validating payment tokens carefully to mitigate unauthorized payment manipulation.