Executive brief
The Easy PayPal Events & Tickets plugin for WordPress, which allows site owners to sell event tickets and check in attendees via QR codes, contains a security flaw that allows unauthorized access to customer data. By exploiting a hardcoded 'test' password in the QR code scanning feature, an attacker can view sensitive information such as PayPal transaction IDs, customer email addresses, and ticket details. This could lead to the exposure of private customer financial data and event attendee lists.
Technical details
The Easy PayPal Events & Tickets plugin for WordPress (versions prior to 1.4) contains a hardcoded authentication bypass (CWE-798) within its QR code scanning logic. The vulnerable component validates a QR hash using a loose comparison that includes a hardcoded string: `if ($hash == $realhash || $hash == 'test')`. An unauthenticated remote attacker can exploit this by sending a request to the `add_wpeevent_button_qr` action with the `hash` parameter set to 'test'. This allows the attacker to bypass hash verification and retrieve sensitive order details, including PayPal transaction IDs and customer emails, for any order where the post ID can be guessed or enumerated. The vulnerability was addressed in version 1.4 by implementing HMAC-SHA256 with random tokens.
Affected products
- WPPlugin LLC Easy PayPal Events & Tickets < 1.4
Timeline
- 2026-05-02: disclosed: Vulnerability discovered and documented by researcher 4lec4st
- 2026-05-04: advisory: Initial CVE publication and VulnCheck advisory release
- 2026-05-07: patched: Version 1.4 released with security fixes