CVE-2026-8608 describes an insufficient verification of data authenticity vulnerability (CWE-345) in the Event Monster – Event Manager, Ticket Booking & Registration WordPress plugin. The capture_payment() AJAX handler (wp_ajax_nopriv_em_capture_payment) trusts client-supplied payment details such as transaction ID, amount, and payment status without server-side validation against PayPal or other payment APIs. Additionally, it lacks nonce and capability checks, enabling unauthenticated attackers to forge payment confirmations and obtain valid booking tickets without payment.

An attacker can bypass payment verification to mark bookings as completed fraudulently and receive valid confirmation emails with QR code tickets. This compromises the integrity of the payment process and booking system, potentially causing financial loss and undermining trust in the event management system. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected AJAX handler or restricting access to it via custom code or security plugins. Monitoring for suspicious booking activity may help detect exploitation attempts.