A critical authentication bypass flaw in the WP Events Manager plugin allows users to register for paid events without payment, posing a risk to revenue and data integrity.

The plugin suffers from improper authentication (CWE-287) where it fails to validate registration quantities against payment status. This allows any authenticated user to manipulate the quantity parameter to generate a completed booking for paid events without actual payment.

Exploitation of this flaw can lead to significant financial loss and unauthorized access to restricted event content or services. With a CVSS score of 9.8, the vulnerability represents a critical risk to the business logic of the application and the integrity of the booking system.

Immediate Action: Update the WP Events Manager plugin to version 2.2.5 or higher to resolve the payment validation logic.

Proactive Monitoring: Review booking and payment logs for discrepancies where registrations appear as completed without corresponding transaction records.

Compensating Controls: Temporarily disable online registration if an update cannot be applied immediately, or implement manual verification for all high-value event registrations.

Public Exploit Available: Unknown.

Site administrators managing paid events must apply the update immediately to prevent unauthorized bookings. Failure to patch allows attackers to bypass payment mechanisms, directly impacting the financial operations of the affected organization.