CVE-2026-41471
Information Disclosure in Easy PayPal Events & Tickets WordPress Plugin
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| easy_paypal_events_and_tickets | plugin | to 1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to enumerate and retrieve all customer order records from the Easy PayPal Events & Tickets plugin for WordPress. This exposure of customer data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access.
Specifically, the unauthorized disclosure of customer order information may violate principles of data confidentiality and privacy mandated by these standards, potentially resulting in legal and regulatory consequences for affected organizations.
Can you explain this vulnerability to me?
The Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier has an information disclosure vulnerability in its QR code scanning endpoint.
This vulnerability allows unauthenticated attackers to enumerate and retrieve all customer order records by iterating over sequential WordPress post IDs through the scan_qr.php endpoint.
Attackers do not need authentication or prior knowledge of specific order identifiers to harvest the complete set of orders stored in the database.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of all customer order records stored by the plugin.
Attackers can access sensitive customer information without authentication, potentially leading to privacy breaches and misuse of customer data.