The Event Monster plugin’s AJAX handler accepts client‑supplied payment data such as transaction ID, amount and status without any server‑side verification or nonce checks, allowing an attacker to forge payment records, mark event bookings as completed and obtain valid QR code tickets and confirmation emails without paying. This flaw enables financial fraud and unauthorized event access.

The vulnerability affects the Event Monster – Event Manager, Ticket Booking & Registration WordPress plugin from awordpresslife, versions up to and including 2.1.0. The plugin is widely used on WordPress sites that host events and sell tickets.

The CVSS score of 5.3 suggests medium severity. EPSS information is not available, so the exploitation likelihood is uncertain, but the attack vector is unauthenticated via the wp_ajax_nopriv_em_capture_payment endpoint, meaning anyone can exploit it. The issue is not listed in CISA’s KEV catalog, yet it allows attackers to bypass payment gateways entirely.