EUVD-2026-27045Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Easy PayPal Events & Tickets plugin for WordPress version 1.3 and earlier contain a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID. This plugin was officially closed as of 2026-03-18.
AnalysisAI
Hardcoded authentication bypass in Easy PayPal Events & Tickets plugin allows unauthenticated remote attackers to retrieve sensitive order data by supplying 'test' as the hash parameter to the QR code scanning endpoint. Attackers can access PayPal transaction IDs, customer emails, purchase amounts, and ticket information for any order by enumerating post IDs. Public exploit code exists on GitHub, significantly lowering the exploitation barrier. The plugin was officially closed by WordPress.org on 2026-03-18, leaving installations vulnerable with no future patches.
Technical ContextAI
This vulnerability stems from CWE-798 (Use of Hard-coded Credentials), a design flaw where static authentication values are embedded in source code. The plugin's QR code verification system accepts the hardcoded string 'test' to bypass cryptographic hash validation on the add_wpeevent_button_qr WordPress action hook. Legitimate QR code scanning should validate dynamically-generated hashes that tie specific orders to authorized requesters. Instead, the hardcoded bypass creates a universal skeleton key. The affected product is identified as cpe:2.3:a:scott_paterson:easy-paypal-events-tickets:*:*:*:*:*:*:*:* covering all versions through 1.3. This reflects a fundamental authentication architecture failure where security controls can be completely disabled through predictable input, typical of insufficiently reviewed third-party WordPress plugins.
RemediationAI
Immediately uninstall Easy PayPal Events & Tickets plugin from all WordPress installations as no patch exists and none will be released following the plugin's official closure on 2026-03-18. Navigate to WordPress admin Plugins page, deactivate, then delete the plugin completely. Audit web server logs for suspicious requests to wp-admin/admin-ajax.php containing action=add_wpeevent_button_qr to identify potential prior exploitation. Consider switching to actively maintained alternatives such as Event Tickets by Modern Tribe or WP Event Manager with integrated payment processing. If immediate removal disrupts business operations, implement emergency compensating controls: add Web Application Firewall rules blocking requests where action=add_wpeevent_button_qr and hash=test appear together (note this only blocks the known exploit method, not potential variants), restrict wp-admin/admin-ajax.php access to authenticated users via server configuration, and enable comprehensive logging of all AJAX endpoint access for forensic review. These workarounds provide only temporary risk reduction and do NOT eliminate the vulnerability-full plugin removal remains the only complete remediation. Consult VulnCheck advisory at https://www.vulncheck.com/advisories/easy-paypal-events-tickets-authentication-bypass-via-qr-code-scanning for additional technical details.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today