{
 "id": "WPSEC-2026-3116",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3116/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3116/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3116/index.md",
 "title": "Events Made Easy <= 3.3.8 - Unauthenticated Payment Bypass via Stripe Checkout Webhook",
 "description": "The Events Made Easy plugin for WordPress is vulnerable to a payment bypass via the Stripe webhook notification handler (eme_notification_stripe) in all versions up to, and including, 3.3.8, due to the handler marking a payment as paid on any 'checkout.session.completed' event without checking the session's payment_status. When asynchronous payment methods such as SEPA or Bacs direct debit are enabled for Stripe Checkout, this event arrives while the session is still unpaid. This makes it possible for unauthenticated attackers to choose such a payment method, never settle the payment, and still have their booking or membership marked as paid.",
 "plugin": {
  "slug": "events-made-easy",
  "name": "Events Made Easy",
  "full_name": "Events Made Easy",
  "wordpress_org": "https://wordpress.org/plugins/events-made-easy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-made-easy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-made-easy"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.2.2",
    "from_inclusive": true,
    "to": "3.3.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.2.2 before 3.3.9"
  ]
 },
 "introduced_in": "2.2.2",
 "fixed_in": "3.3.9",
 "remediation": "Update to 3.3.9 or later.",
 "fix_released": "2026-11-12T22:51:36+00:00",
 "published": "2026-11-13T23:41:37+00:00",
 "updated": "2026-11-13T15:55:01.036465+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3116/",
  "https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.9/",
  "https://wordpress.org/plugins/events-made-easy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-made-easy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}