Events Made Easy < 3.1.2 – Unauthenticated Payment Bypass | CVE 2026-14842

Description

The plugin does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.

Proof of Concept

Prerequisites: a payment gateway (Stripe or PayPal) is configured and at least one paid event exists.

1. Book a cheap item (e.g. 1.00) through the public RSVP form. On the payment page, read the hidden charge-form fields: price=100 (in cents), cur=USD, and eme_stripe_nonce. This nonce is bound only to the "100USD" action.

2. Book the expensive event you want covered (e.g. 500.00) and note its payment_id from its own payment form (payment ids are sequential and enumerable).

3. Submit the forged charge with the cheap price and cheap nonce, but the expensive payment_id:

curl -X POST "https://victim.example/?eme_eventAction=stripe_charge" \
  -d "payment_id=VICTIM_PID" \
  -d "price=100" \
  -d "cur=USD" \
  -d "description=poc" \
  -d "eme_stripe_nonce=NONCE"

4. Pay 1.00 at the gateway. The booking identified by VICTIM_PID is then marked fully paid even though only 1.00 was captured.

PayPal is identical via eme_eventAction=paypal_charge.