# EventPrime <= 4.3.5.1 - Unauthenticated Payment Bypass via PayPal Order Reuse

- **ID:** WPSEC-2026-1633
- **Plugin:** EventPrime – Events Calendar, Bookings, Tickets & AI (`eventprime-event-calendar-management`), https://wordpress.org/plugins/eventprime-event-calendar-management/
- **Affected versions:** all versions before 4.3.6.0
- **Fixed in:** 4.3.6.0 (Update to 4.3.6.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-841
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/eventprime-event-calendar-management
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1633/

## Description

The EventPrime plugin for WordPress is vulnerable to a payment bypass via the ep_paypal_sbpr AJAX action in all versions up to, and including, 4.3.5.1. This is due to the PayPal confirmation handler checking only a PayPal order's status, amount, currency and client-supplied custom ID, and never recording or checking which booking an order has already confirmed. This makes it possible for unauthenticated attackers, on sites with PayPal payments and guest booking or checkout registration enabled, to reuse one paid PayPal order to confirm several bookings with the same total while paying only once.

## References

- https://wpsec.com/vuln/WPSEC-2026-1633/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.6.0/
- https://wordpress.org/plugins/eventprime-event-calendar-management/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1633/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.