CVE-2026-41471CWE-639

Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint

High · published May 4, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00603 · 48.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-04T17:40Z
EPSS history
Timeline
  • 04 MAY 17:40Z
    Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint
    cvelistv5