Vulnerabilities / EventPrime / WPSEC-2026-1633
EventPrime <= 4.3.5.1 - Unauthenticated Payment Bypass via PayPal Order Reuse
Medium 5.3
CWE-841Fixed in 4.3.6.0
- ID
- WPSEC-2026-1633
- Plugin
- EventPrime – Events Calendar, Bookings, Tickets & AI (eventprime-event-calendar-management)
- Affected
- all versions before 4.3.6.0
- Remediation
- Update to 4.3.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-841
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- EventPrime on WPSec AttackSurface
- Fix released
- Published
Description
The EventPrime plugin for WordPress is vulnerable to a payment bypass via the ep_paypal_sbpr AJAX action in all versions up to, and including, 4.3.5.1. This is due to the PayPal confirmation handler checking only a PayPal order's status, amount, currency and client-supplied custom ID, and never recording or checking which booking an order has already confirmed. This makes it possible for unauthenticated attackers, on sites with PayPal payments and guest booking or checkout registration enabled, to reuse one paid PayPal order to confirm several bookings with the same total while paying only once.
References
- https://wpsec.com/vuln/WPSEC-2026-1633/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.6.0/
- https://wordpress.org/plugins/eventprime-event-calendar-management/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS