Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hard‑coded authentication bypass in its QR code scanning feature that allows unauthenticated remote attackers to bypass hash verification by providing the literal string "test" as the hash parameter. The vulnerability is exposed via the add_wpeevent_button_qr action and enables attackers to retrieve sensitive order data, including PayPal transaction IDs, customer email addresses, purchase amounts and ticket information for any order whose post ID can be guessed or known. This flaw represents a classic CWE‑798 error: reliance on hard‑coded credentials or values.

All WordPress sites installed with Easy PayPal Events & Tickets version 1.3 or earlier are affected. The plugin has not received updates since version 1.3, leaving the hard‑coded bypass in place for any legacy installation.

The CVSS score of 8.7 flags the vulnerability as high severity, while the EPSS score of <1% indicates a very low probability of exploitation at present. It is not listed in the CISA KEV catalog. The vulnerable endpoint is reachable via a standard HTTP request without requiring authentication, so remote attackers can exploit the flaw over the Internet if the site is publicly reachable. The attack requires knowledge of the plugin’s endpoint URL and a valid or guessable post identifier, but no installation or privileged credentials are needed.