Vulnerability · Published Aug 7, 2026 · Assigned by WPScan

CVE-2026-15148WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

Medium 5.3

In plain English

A medium-severity insufficient verification of data authenticity in WP Events Manager from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Events Manager	0 – before 2.2.5

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/08d4761f-ddc6-48f4-909e-db38438e385e/ exploit, vdb-entry, technical-description