EUVD-2026-27050Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers. This plugin was officially closed as of 2026-03-18.
AnalysisAI
Unauthenticated attackers can enumerate and exfiltrate all customer order records from Easy PayPal Events & Tickets plugin for WordPress through an exposed QR code scanning endpoint. The scan_qr.php file accepts sequential WordPress post IDs without authentication, enabling complete database harvesting of payment and customer information. Publicly available exploit code exists, but no evidence of active exploitation (not in CISA KEV). The plugin was officially closed and removed from WordPress.org on 2026-03-18, leaving existing installations vulnerable with no official patch path.
Technical ContextAI
This vulnerability (CWE-639) represents an Authorization Bypass Through User-Controlled Key flaw in the Easy PayPal Events & Tickets WordPress plugin's QR code validation system. The scan_qr.php endpoint was designed to validate event tickets by scanning QR codes but implements no authentication checks or access controls. WordPress stores custom post types (including order records) with sequential integer IDs, and the vulnerable endpoint accepts these IDs as direct parameters. An attacker can programmatically iterate through ID ranges (e.g., 1-10000) to retrieve every order record containing customer names, email addresses, payment amounts, and event details. The CPE string (cpe:2.3:a:scott_paterson:easy-paypal-events-tickets:*:*:*:*:*:*:*:*) identifies all versions through 1.3 as affected. This architectural flaw bypasses WordPress's normal permission system by exposing a direct database query interface without capability checks.
RemediationAI
Immediately remove Easy PayPal Events & Tickets plugin from all WordPress installations as no security patch exists and the vendor has discontinued support. Migrate to an actively maintained alternative such as Event Espresso, The Events Calendar with WooCommerce integration, or WP Event Manager. Before removal, export critical order/customer data through WordPress admin dashboard for record retention. After uninstallation, verify scan_qr.php and all plugin files are deleted from wp-content/plugins/ directory. As compensating controls for installations that cannot immediately migrate: (1) Block direct access to scan_qr.php via web application firewall rules or .htaccess deny directives-this prevents exploitation but breaks legitimate QR scanning functionality; (2) Restrict wp-content/plugins/easy-paypal-events-tickets/ directory access to authenticated admin users only through nginx/Apache configuration-note this will disable all plugin features including frontend ticket sales. Conduct incident response review: audit web server access logs for suspicious POST/GET requests to scan_qr.php with sequential ID parameters (pattern: ?id=1, ?id=2, etc.) to determine if data exfiltration has occurred. Notify affected customers per GDPR Article 33/34 if breach evidence found. Advisory: https://www.vulncheck.com/advisories/easy-paypal-events-tickets-information-disclosure-via-qr-code-endpoint
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today