The Easy PayPal Events & Tickets WordPress plugin up to version 1.3 contains a hardcoded authentication bypass in its QR code scanning routine. An attacker who provides the string 'test' as a hash value can trick the plugin into skipping real hash verification. This allows unauthenticated remote attackers to reach the add_wpeevent_button_qr action and obtain detailed order information such as PayPal transaction identifiers, customer email addresses, purchase amounts, and ticket metadata. The vulnerability can be used to harvest confidential order data from any site that has the plugin installed and has not removed or updated it.

All WordPress sites running Easy PayPal Events & Tickets version 1.3 or earlier are affected. The plugin has been officially closed as of March 18 2026, but legacy installations that have not been removed remain vulnerable.

The CVSS score of 8.7 indicates a high severity event. EPSS data is not available, so exploitation likelihood cannot be quantified from that metric, and the flaw is not listed in the CISA KEV catalog. Given that the vulnerable endpoint is accessible via a standard HTTP request without authentication, remote attackers can exploit the flaw from the internet if the site is reachable. The attack vector is inferred to be remote, command-and-control style, and exploitation requires only knowledge of the plugin’s endpoint and a target post ID.