CVE-2026-32834

Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/4lec4st/eb20f9934f8c23b4b241f74a8d884ce9
https://wordpress.org/plugins/easy-paypal-events-tickets
https://www.vulncheck.com/advisories/easy-paypal-events-tickets-authentication-bypass-via-qr-code-scanning

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El plugin Easy PayPal Events & Tickets para WordPress versión 1.3 y anteriores contienen una vulnerabilidad de omisión de autenticación codificada en la funcionalidad de escaneo de códigos QR que permite a atacantes remotos no autenticados omitir la verificación de hash al proporcionar ’test’ como parámetro de hash. Los atacantes pueden acceder al endpoint vulnerable a través de la acción add_wpeevent_button_qr para recuperar detalles sensibles de pedidos, incluyendo IDs de transacción de PayPal, direcciones de correo electrónico de clientes, montos de compra e información de tickets para cualquier pedido con un ID de publicación conocido o adivinado. Este plugin fue cerrado oficialmente a partir del 18-03-2026.

Information

Published : 2026-05-04 18:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-32834

Mitre link : CVE-2026-32834

CVE.ORG link : CVE-2026-32834

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-32834", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32834", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T19:02:20.333620Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Scott Paterson", "product": "easy-paypal-events-tickets", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-05-04T18:16:27.223", "references": [{"url": "https://gist.github.com/4lec4st/eb20f9934f8c23b4b241f74a8d884ce9", "source": "disclosure@vulncheck.com"}, {"url": "https://wordpress.org/plugins/easy-paypal-events-tickets", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/easy-paypal-events-tickets-authentication-bypass-via-qr-code-scanning", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID."}, {"lang": "es", "value": "El plugin Easy PayPal Events & Tickets para WordPress versi\u00f3n 1.3 y anteriores contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n codificada en la funcionalidad de escaneo de c\u00f3digos QR que permite a atacantes remotos no autenticados omitir la verificaci\u00f3n de hash al proporcionar \u2019test\u2019 como par\u00e1metro de hash. Los atacantes pueden acceder al endpoint vulnerable a trav\u00e9s de la acci\u00f3n add_wpeevent_button_qr para recuperar detalles sensibles de pedidos, incluyendo IDs de transacci\u00f3n de PayPal, direcciones de correo electr\u00f3nico de clientes, montos de compra e informaci\u00f3n de tickets para cualquier pedido con un ID de publicaci\u00f3n conocido o adivinado. Este plugin fue cerrado oficialmente a partir del 18-03-2026."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "disclosure@vulncheck.com"}