The WP Events Manager WordPress plugin prior to version 2.2.5 fails to verify that incoming payment notifications originate from the configured merchant account and does not confirm that the paid amount matches the booking total. This insufficient verification (CWE-345) allows unauthenticated attackers to mark any booking as paid without a legitimate payment being made, potentially affecting the integrity of booking payment status.

An attacker can mark bookings as paid without making a legitimate payment, potentially leading to unauthorized access or use of services tied to paid bookings. This impacts the integrity of the payment process but does not directly affect confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements and apply updates once available. Until then, consider additional verification controls on payment notifications if possible.