CVE-2026-15148: 
WordPress vulnerability analysis and mitigation

CVE-2026-15148 is a payment verification bypass vulnerability in the WP Events Manager WordPress plugin affecting all versions before 2.2.5. The flaw allows unauthenticated attackers to mark any booking as paid without a legitimate payment reaching the merchant, including bookings belonging to other users. It was publicly disclosed on August 3, 2026, and published to the NVD on August 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The plugin's PayPal IPN (Instant Payment Notification) handler, which runs on the site's front page via the init hook for any unauthenticated visitor, fails to verify that the payment notification's receiver email matches the site's configured merchant account and does not validate that the paid amount equals the booking total. An attacker can exploit this by sending a crafted HTTP POST request to the victim site's front page, supplying an attacker-controlled custom field containing any target booking ID — an Insecure Direct Object Reference (IDOR) — along with a minimal payment amount and their own PayPal receiver address. Because the plugin only checks that PayPal returns a VERIFIED response (which the attacker can obtain by making a real but trivial payment to their own PayPal account), the booking transitions from pending to completed regardless of the actual payment recipient or amount (WPScan, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to fraudulently mark any booking — including those belonging to other users — as paid without transferring funds to the site's merchant. This results in financial loss for event organizers, as attackers can obtain event registrations without paying, and undermines the integrity of the booking and payment system. There is no confidentiality or availability impact; the primary consequence is integrity tampering of booking records and financial fraud (WPScan, GitHub Advisory).

A proof-of-concept (PoC) is publicly available via WPScan, demonstrating exploitation using a simple curl command. The vulnerability is automatable (no user interaction or authentication required) and exploitable over the network with low attack complexity. No evidence of active in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.114% (2nd percentile), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running WP Events Manager versions before 2.2.5 with the PayPal payment gateway enabled and at least one booking in "pending" state. Tools like WPScan or manual inspection of plugin version metadata can confirm the vulnerable version.
2. Enumerate booking IDs: Since booking IDs are numeric and referenced via the custom field, an attacker can enumerate or guess valid pending booking IDs (IDOR). The attacker's own booking ID (obtained by initiating a registration) can also be used.
3. Obtain a PayPal VERIFIED response: The attacker makes a real but minimal payment (e.g., $0.01) to a PayPal account they control, generating a legitimate VERIFIED IPN response from PayPal.
4. Craft and send the malicious IPN POST: The attacker sends a crafted HTTP POST to the victim site's front page, mimicking a PayPal IPN notification with the target booking ID in the custom field, their own receiver email, and a trivial payment amount:

curl -sk -X POST 'https://victim.example/' \
  --data-urlencode 'txn_type=web_accept' \
  --data-urlencode 'payment_status=Completed' \
  --data-urlencode 'txn_id=<REAL_TXN_ID>' \
  --data-urlencode 'mc_gross=0.01' \
  --data-urlencode 'mc_currency=USD' \
  --data-urlencode 'receiver_email=attacker@paypal.example' \
  --data-urlencode 'business=attacker@paypal.example' \
  --data-urlencode 'custom={"booking_id":{BOOKING_ID},"user_id":1}'

5. Booking status updated: The plugin's IPN handler verifies the transaction with PayPal, receives VERIFIED, and marks the target booking as paid — without checking the receiver or amount — transitioning it from pending to completed (WPScan).

• Network: Unexpected HTTP POST requests to the WordPress site's front page (/) with PayPal IPN-style parameters (txn_type, payment_status, custom, receiver_email) where receiver_email or business does not match the site's configured merchant PayPal account; requests with mc_gross values significantly below the event booking price.
• Logs: WordPress/web server access logs showing POST requests to the site root from unusual IP addresses with IPN-like payloads; repeated requests with varying custom field values (indicating booking ID enumeration).
• Application Data: Booking records transitioning from "pending" to "completed" (paid) status without corresponding legitimate payment records in the merchant's PayPal account; bookings marked paid with mc_gross values far below the event price or with mismatched receiver emails in transaction logs (WPScan).

Update the WP Events Manager WordPress plugin to version 2.2.5 or later, which addresses the payment verification bypass. As an interim measure, site administrators can disable the PayPal payment gateway within the plugin settings until the update is applied. Additionally, implement network-level controls or a web application firewall (WAF) rule to restrict IPN notification sources to known PayPal IP ranges, and monitor booking records for suspicious payment confirmations that do not correspond to legitimate merchant transactions (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Muni Nitish Kumar Yaddala and verified by WPScan. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (WPScan).