PT-2026-36874 · WordPress · Easy Paypal Events & Tickets

4Lec4St · CVE-2026-32834 · Published 2026-05-04 · Updated 2026-05-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier

Description A hardcoded authentication bypass exists in the QR code scanning functionality. Unauthenticated remote attackers can bypass hash verification by providing 'test' as the value for the hash parameter. By accessing the 'add wpeevent button qr' endpoint, attackers can retrieve sensitive order details, including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information, provided they have a known or guessed post ID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-32834

Affected Products

Easy Paypal Events & Tickets

References · 7

• 🔥 https://gist.github.com/4lec4st/eb20f9934f8c23b4b241f74a8d884ce9 · Exploit
• https://wordpress.org/plugins/easy-paypal-events-tickets · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32834 · Security Note
• https://twitter.com/CVEnew/status/2051361255055606200 · Twitter Post
• https://t.me/CVEtracker/52656 · Telegram Post
• https://vulncheck.com/advisories/easy-paypal-events-tickets-authentication-bypass-via-qr-code-scanning · Note
• https://twitter.com/VulmonFeeds/status/2051411334642774135 · Twitter Post