WordPress Events Manager Price Validation Bypass

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14205 is a critical authentication bypass vulnerability in the WP Events Manager WordPress plugin that allows authenticated users to register for paid events without payment. The flaw stems from insufficient input validation on event registration quantities—the plugin fails to verify that the quantity parameter matches legitimate event inventory, instead computing the final price directly from attacker-controlled input. This enables any logged-in user to manipulate the quantity field to zero or negative values, resulting in free or negative charges that bypass payment processing entirely. The vulnerability is particularly severe because it affects e-commerce functionality across thousands of WordPress sites using this plugin, directly impacting revenue streams and exposing businesses to financial fraud.

Casky's security skills detect this vulnerability pattern by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access), identifying the logical flaw where user-supplied parameters influence security-critical calculations without proper validation. With 283 matching skills leveraging Claude's extended reasoning, practitioners using Casky would observe detection findings focused on: (1) input validation gaps in payment processing workflows, (2) authorization logic that trusts client-side quantity submissions, and (3) price calculation functions that lack server-side verification. The platform's skill-based detection would highlight suspicious patterns such as quantity parameter anomalies in HTTP requests, discrepancies between submitted and verified event allocations, and completed transactions with unexpected or zero-value charges—enabling teams to identify exploitation attempts before financial loss occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14205.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14205

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14205. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn