CRITICAL 9.8 NVD
CVE-2026-14205
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the a
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
References
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-08-07 via NVD.
Risk Timeline
CVE Disclosed2026-08-07 · 2 days ago
Remediation Resources
Official Advisory
wpscan.com/vulnerability/084705cc-eb47-4e5f-9e7a-1bc0d6b218a4/
vulnfeed aggregates 9044 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.