TI-2026-25298 Aliases CVE-2026-32834 GHSA-p3hr-535h-p5qw

Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning

HIGH 77CWE-798Published 2026-05-04 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00448 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed easy-paypal-events-tickets (Scott Paterson): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Scott Paterson	easy-paypal-events-tickets	before 1.4.0	1.4.0	Patch available	CNA

easy-paypal-events-tickets VendorScott Paterson Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

Remediation

Fix · CNA easy-paypal-events-tickets (Scott Paterson) Fixed in 1.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-04
Scott Paterson easy-paypal-events-tickets 1.4.0
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2026-30060 Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code EndpointPriority HIGH 75
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-32834
2026-10-03 Alias added: GHSA-p3hr-535h-p5qw
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

https://gist.github.com/4lec4st/eb20f9934f8c23b4b241f74a8d884ce9

Patch 1

https://wordpress.org/plugins/easy-paypal-events-tickets

TI-2024-33923 WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-30060 Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint CVSS 4.0HIGH 8.2
TI-2022-04229 Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode CVSS 3.1MEDIUM 5.4
TI-2024-08900 Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution CVSS 3.1HIGH 8.3
TI-2025-31350 WordPress Easy Stripe plugin <= 1.1 - Remote Code Execution (RCE) Vulnerability CVSS 3.1CRITICAL 10.0
TI-2023-10027 WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences