blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-8608

MEDIUM 5.3 CVSS 3.1
Published
June 6, 2026
Last modified
July 23, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.

Affected WordPress components

  • Event Monster – Event Manager, Event Booking, Event Ticket & Registration Plugin · event-monster
    Confirmed match Active
    Up to and including 2.1.0
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • awordpresslife Event Monster – Event Manager, Ticket Booking & Registration — Up to and including 2.1.0

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php#L844
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php#L890
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php#L92
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3554570%40event-monster&new=3554570%40event-monster&sfp_email=&sfph_mail=
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/daddfbd2-cff4-4caa-bbdc-9945a635a1d6?source=cve
  • nvd.nist.gov Official NVD record