Events Made Easy <= 3.1.1 - Unauthenticated Payment Bypass

The Events Made Easy plugin for WordPress is vulnerable to Payment Bypass in versions up to, and including, 3.1.1. This is due to insufficient nonce binding in payment gateway form handlers, where nonces were scoped only to price and currency ("$price$cur") rather than to a specific payment ID, allowing a nonce obtained from one payment context to satisfy verification for any other payment with a matching price and currency string. This makes it possible for unauthenticated attackers to manipulate the payment amount submitted to any payment gateway, completing a booking or membership payment for an arbitrarily low price by reusing a valid nonce obtained from a cheaper (or free) payment form.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Events Made Easy 3.1.2 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts