CVE-2026-32834
HighSummary
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality. Attackers can exploit this flaw by supplying 'test' as the hash parameter, allowing access to sensitive order details.
Risk Assessment
Organizations may be exposed to the theft of sensitive information such as PayPal transaction IDs, customer email addresses, and order details, potentially leading to financial losses and privacy breaches.
Recommendation
It is recommended to update the Easy PayPal Events & Tickets plugin to version 1.4 or later to mitigate this vulnerability. Additionally, monitoring access to sensitive data and implementing further security measures is advisable.
Other vulnerabilities in Easy PayPal Events & Tickets plugin for WordPress
Original NVD description (English source)
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.