Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:16:29 +0000 CVE-2026-15148 — WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR https://vulnerability.circl.lu/vuln/cve-2026-15148 <p><strong>Affected:</strong> Unknown WP Events Manager</p> <p>The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site&#39;s configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users&#39; bookings.</p> <p><strong>Affected:</strong> Unknown WP Events Manager</p> <p>The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site&#39;s configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users&#39; bookings.</p> https://vulnerability.circl.lu/vuln/cve-2026-15148