CVE-2026-14842 affects the Events Made Easy WordPress plugin versions prior to 3.1.2. The vulnerability arises because the plugin does not bind the payment authorization token to the specific payment record being charged. Consequently, an attacker can exploit this by submitting payment for a low-cost booking while causing a different, more expensive booking to be marked as paid. This is an authorization bypass issue categorized under CWE-639. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild.

An unauthenticated attacker can manipulate payment processing to mark higher-priced bookings as paid by paying only a low amount for a cheaper booking. This can lead to financial loss for the site owner due to unauthorized payment manipulation. There is no indication of confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from the plugin vendor and consider restricting plugin usage or payment processing until the issue is resolved.