The Easy PayPal Events & Tickets plugin for WordPress versions prior to 1.4 contains an information disclosure flaw in the QR‑code scanning endpoint. An unauthenticated attacker can iterate over WordPress post IDs via scan_qr.php to enumerate and retrieve all customer order records stored in the database, without authentication or prior knowledge of specific order IDs.

WordPress sites that have installed the Easy PayPal Events & Tickets plugin version 1.3 or earlier. The plugin is developed by Scott Paterson.

The CVSS score of 8.2 indicates a high impact vulnerability, but the EPSS score of < 1% shows a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw simply by sending HTTP requests to the scan_qr.php endpoint without any prior knowledge or credentials. The lack of authentication control and the ability to iterate over post IDs make exploitation straightforward.