PT-2026-36876 · WordPress · Easy Paypal Events & Tickets

4Lec4St · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-41471

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier

Description An information disclosure issue exists in the QR code scanning endpoint. Unauthenticated attackers can enumerate and retrieve all customer order records by iterating over sequential WordPress post IDs through the 'scan qr.php' endpoint, allowing them to harvest the complete set of orders stored in the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41471

Affected Products

Easy Paypal Events & Tickets

References · 8

• 🔥 https://gist.github.com/4lec4st/9fd04b4bfadb3f7e388f61588f5f2564 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41471 · Security Note
• https://wordpress.org/plugins/easy-paypal-events-tickets/#developers · Patch
• https://vulncheck.com/advisories/easy-paypal-events-tickets-information-disclosure-via-qr-code-endpoint · Note
• https://twitter.com/VulmonFeeds/status/2051406214047625575 · Twitter Post
• https://twitter.com/CVEnew/status/2051361254057378208 · Twitter Post
• https://wordpress.org/plugins/easy-paypal-events-tickets · Note
• https://t.me/CVEtracker/52657 · Telegram Post