CVE-2026-14842

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148435.3The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handl CVE-2026-148446.8The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in a CVE-2026-148456.1The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storin CVE-2026-148464.5In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation CVE-2026-148474.3The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related A CVE-2026-148485.4The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-sub CVE-2026-148493.7The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predict CVE-2026-14852.8A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is sto CVE-2026-148508.8The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An a CVE-2026-148519.2A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally ide CVE-2026-148525.2Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local CVE-2026-148534.3The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check c