CVE-2026-14205: unknown wp events manager Improper Authentication
Vulnerability summary
CVE-2026-14205 is a critical (CVSS 9.8) Improper Authentication vulnerability in unknown wp events manager. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.2.5.
Timeline
- 07-08-2026PublishedVulnerability first disclosed.
- 07-08-2026Last modifiedVulnerability information updated.
Description
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.21 pp
From 0.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- wp events manager< 2.2.5
Wordpress1 product
- wp-events-manager≤ 2.2.4 (fixed in 2.2.5)
2 vendors · 2 products