CVE-2026-41471
High
Description
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.
SeverityHigh
CVSS7.5
Exploit probability—
ProductScott Paterson Easy-paypal-events-tickets
PublishedMay 4, 2026
First seenMay 4, 2026
How to fix
Update
- Scott Paterson easy-paypal-events-tickets1.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Scott Paterson easy-paypal-events-tickets | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.