Events Made Easy <= 3.3.8 - Unauthenticated Payment Bypass via Stripe Checkout Webhook
- ID
- WPSEC-2026-3116
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- from 2.2.2 before 3.3.9
- Remediation
- Update to 3.3.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to a payment bypass via the Stripe webhook notification handler (eme_notification_stripe) in all versions up to, and including, 3.3.8, due to the handler marking a payment as paid on any 'checkout.session.completed' event without checking the session's payment_status. When asynchronous payment methods such as SEPA or Bacs direct debit are enabled for Stripe Checkout, this event arrives while the session is still unpaid. This makes it possible for unauthenticated attackers to choose such a payment method, never settle the payment, and still have their booking or membership marked as paid.
References
- https://wpsec.com/vuln/WPSEC-2026-3116/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.9/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS