Two add-ons also have security updates from the Security Hunt. For the background, see our main release post.
The Stripe one matters most: a single paid Stripe PaymentIntent could approve more than one booking. If you take payments through the Stripe Elements gateway, update to Events Manager Pro – Stripe 2.5.2. Events Manager – Connect 1.0.1 hardens how its WhatsApp and Telegram webhooks check their secrets.
Changelog
Events Manager Pro – Stripe 2.5.2
- Security: Fixed a payment bypass where one paid Stripe PaymentIntent could approve additional bookings, reported by mercurystorm via the Security Hunt
- Fixed: The Elements test publishable key was read from the wrong variable when localizing the payment script (props Will Pom)
Events Manager – Connect 1.0.1
- Security: Hardened webhook secret handling for the WhatsApp and Telegram integrations, rejecting blank or forged secrets and using constant-time comparison, reported by Will Pom via the Security Hunt