# Events Made Easy <= 3.3.8 - Unauthenticated Payment Bypass via Stripe Checkout Webhook

- **ID:** WPSEC-2026-3116
- **Plugin:** Events Made Easy (`events-made-easy`), https://wordpress.org/plugins/events-made-easy/
- **Affected versions:** from 2.2.2 before 3.3.9
- **Fixed in:** 3.3.9 (Update to 3.3.9 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-made-easy
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3116/

## Description

The Events Made Easy plugin for WordPress is vulnerable to a payment bypass via the Stripe webhook notification handler (eme_notification_stripe) in all versions up to, and including, 3.3.8, due to the handler marking a payment as paid on any 'checkout.session.completed' event without checking the session's payment_status. When asynchronous payment methods such as SEPA or Bacs direct debit are enabled for Stripe Checkout, this event arrives while the session is still unpaid. This makes it possible for unauthenticated attackers to choose such a payment method, never settle the payment, and still have their booking or membership marked as paid.

## References

- https://wpsec.com/vuln/WPSEC-2026-3116/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.9/
- https://wordpress.org/plugins/events-made-easy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3116/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.