CVE-2026-32834
High
Description
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.
SeverityHigh
CVSS7.5
Exploit probability—
ProductScott Paterson Easy-paypal-events-tickets
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- Scott Paterson easy-paypal-events-tickets1.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Scott Paterson easy-paypal-events-tickets | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.