Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-07 | 2 | Disclosure2 |
| 2026-06-14 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-8608-event-monster-version-2-1-0-medium-vulnerability-proof-of-concept CVE-2026-8608 event-monster (CVSS Score 5.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #…
Post summary
The tweet promotes a proof‑of‑concept for CVE‑2026‑8608, providing a CVSS score but no exploit code, active‑use evidence, or patch information.
🚨*CVE* CVE-2026-8608 The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, a… https://www.cve.org/CVERecord?id=CVE-2026-8608 ----- Traducción: CVE-2026-8608 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-8608 for the WordPress Event Monster plugin, indicating an insufficient data authenticity verification issue but providing no info on patches, exploits, or PoC.
CVE-2026-8608 The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, a… https://www.cve.org/CVERecord?id=CVE-2026-8608
Post summary
The statement confirms CVE‑2026‑8608 affects the Event Monster WordPress plugin, describing it as an insufficient verification of data authenticity flaw in certain versions, without providing PoC, exploit, or mitigation details.