CVE-2026-41471
HighSummary
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records.
Risk Assessment
Attackers can access the complete set of orders stored in the database, leading to serious privacy breaches and security risks for customer data.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and to monitor access to the QR code scanning endpoint.
Other vulnerabilities in Easy PayPal Events & Tickets plugin for WordPress
Original NVD description (English source)
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.