CVE-2026-8608 describes an insufficient verification of data authenticity vulnerability (CWE-345) in the Event Monster – Event Manager, Ticket Booking & Registration WordPress plugin versions up to and including 2.1.0. The vulnerability arises because the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusts client-supplied payment data such as transaction ID, amount, and payment status without verifying these details against the PayPal API or any other payment gateway. Additionally, the handler lacks nonce or capability checks, enabling unauthenticated attackers to forge payment records, mark bookings as completed, and obtain confirmation emails with valid QR code tickets without making actual payments.

An attacker can exploit this vulnerability to bypass payment verification, resulting in forged payment records and unauthorized completion of bookings. This leads to issuance of valid confirmation emails and QR code tickets without any actual payment, causing potential revenue loss and fraudulent access to events.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, consider disabling or restricting access to the vulnerable AJAX handler to prevent exploitation.