Event Booking Manager lets contributors alter site-wide payment settings

Event Booking Manager for WooCommerce through 5.3.7 registers the authenticated AJAX action mep_save_payment_settings_modal without nonce verification. The ajax_save_payment_settings_modal() handler authorizes anyone with either manage_options or edit_posts, so a Contributor satisfies the check. It reads attacker-controlled POST values including mep_enable_wc_payment, mep_wc_add_to_cart_redirect, mep_wc_after_order_redirect, mep_wc_require_login, mep_confirmation_page_id, and mep_wc_confirm_ticket_status, then writes them to the site-wide payment_setting_sec option. A Contributor can therefore change payment enablement, checkout redirects, login requirements, confirmation-page selection, and which order statuses confirm tickets for every event booking. Version 5.3.8 verifies the mep_save_payment_settings nonce and requires manage_options.