Threats tagged 'ghsa-6g36-5qr8-2jpf'

WP Events Manager plugin versions before 2.2.5 contain a vulnerability where payment notifications are not properly verified. This allows unauthenticated users to mark bookings as paid without actual payment, including bookings of other users. The flaw is due to insufficient verification of data authenticity in payment notifications.