Executive brief
The Easy PayPal Events & Tickets plugin for WordPress, which allows site owners to sell event tickets and generate QR codes for check-ins, contains a security flaw in its QR code scanning system. An unauthorized attacker can exploit this flaw to view and download sensitive customer order information, including email addresses and PayPal transaction details. This could lead to a significant data breach of customer purchase history and personal contact information.
Technical details
The vulnerability is classified as an Insecure Direct Object Reference (IDOR) / Authorization Bypass through a user-controlled key (CWE-639) within the `scan_qr.php` endpoint. Because order identifiers are based on sequential WordPress post IDs and the endpoint lacks proper authentication checks, an attacker can programmatically iterate through these IDs to harvest the entire database of orders. Exposed data includes PayPal transaction IDs, customer email addresses, purchase details, and order statuses. The issue was addressed in version 1.4 by implementing HMAC-SHA256 tokens and non-predictable identifiers to prevent enumeration.
Affected products
- WPPlugin LLC Easy PayPal Events & Tickets < 1.4
Timeline
- 2026-05-02: disclosed: Initial researcher disclosure on GitHub Gist
- 2026-05-04: advisory: NVD and VulnCheck advisories published
- 2026-05-07: patched: Version 1.4 released with security fixes