CVE-2026-15148: CWE-345 Insufficient Verification of Data Authenticity in WP Events Manager
WP Events Manager plugin versions before 2.2.5 contain a vulnerability where payment notifications are not properly verified. This allows unauthenticated users to mark bookings as paid without actual payment, including bookings of other users. The flaw is due to insufficient verification of data authenticity in payment notifications.
AI Analysis
Technical Summary
The WP Events Manager WordPress plugin prior to version 2.2.5 fails to verify that incoming payment notifications originate from the configured merchant account and that the paid amount matches the booking total. This insufficient verification (CWE-345) enables unauthenticated attackers to mark any booking as paid without legitimate payment, potentially affecting the integrity of booking payment status.
Potential Impact
Attackers can mark bookings as paid without making a legitimate payment, potentially leading to unauthorized access or use of services tied to paid bookings. The integrity of payment processing and booking records is compromised, but confidentiality and availability are not directly affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's announcements for updates and consider restricting access to payment notification endpoints as a temporary measure.
CVE-2026-15148: CWE-345 Insufficient Verification of Data Authenticity in WP Events Manager
Description
WP Events Manager plugin versions before 2.2.5 contain a vulnerability where payment notifications are not properly verified. This allows unauthenticated users to mark bookings as paid without actual payment, including bookings of other users. The flaw is due to insufficient verification of data authenticity in payment notifications.
CVSS v3.1
Score 5.3medium
Affected software
WP Events Manager
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Events Manager WordPress plugin prior to version 2.2.5 fails to verify that incoming payment notifications originate from the configured merchant account and that the paid amount matches the booking total. This insufficient verification (CWE-345) enables unauthenticated attackers to mark any booking as paid without legitimate payment, potentially affecting the integrity of booking payment status.
Potential Impact
Attackers can mark bookings as paid without making a legitimate payment, potentially leading to unauthorized access or use of services tied to paid bookings. The integrity of payment processing and booking records is compromised, but confidentiality and availability are not directly affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's announcements for updates and consider restricting access to payment notification endpoints as a temporary measure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-08T19:33:59.091Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a758c3ebf8831d539f7687b
Added to database: 08/07/2026, 07:41:50 UTC
Last enriched: 08/14/2026, 16:12:44 UTC
Last updated: 09/21/2026, 22:01:32 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.