Executive brief
The Event Monster plugin for WordPress, which manages event bookings and ticket sales, contains a flaw that allows users to bypass payment requirements. An attacker can trick the system into thinking a payment was successful by sending fake transaction data. This results in the attacker receiving valid event tickets and QR codes without actually paying for them, leading to financial loss for the event organizer.
Technical details
The vulnerability exists in the capture_payment() AJAX handler (wp_ajax_nopriv_em_capture_payment) which lacks server-side validation. The component trusts client-supplied data such as transaction IDs, amounts, and payment status without verifying them against payment gateways like PayPal. Additionally, the handler lacks nonce or capability checks. An unauthenticated attacker can exploit this by sending a crafted AJAX request to mark a booking as 'Completed', triggering the system to issue valid QR code tickets and confirmation emails. A patch appears to be available in newer versions based on the provided changeset references.
Affected products
- The Event Monster Event Monster – Event Management, Events Calendar, Tickets Up to, and including, 2.1.0
Timeline
- 2026-06-06: disclosed: Initial disclosure date
- 2026-06-06: advisory: NVD and Wordfence advisory published
References
- https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php
- https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php
- https://plugins.trac.wordpress.org/browser/event-monster/tags/2.0.1/includes/class-event-monster-ajax.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3554570%40event-monster&new=3554570%40event-monster&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/daddfbd2-cff4-4caa-bbdc-9945a635a1d6?source=cve