An unauthenticated attacker can use the QR‑code scanning endpoint to enumerate all customer order records by iterating sequential WordPress post IDs. The plugin fails to enforce any authentication, resulting in the disclosure of complete order data stored in the database.

WordPress sites that have installed the Easy PayPal Events & Tickets plugin version 1.3 or earlier. The plugin is developed by Scott Paterson.

The CVSS score of 8.2 indicates a high impact vulnerability, but no EPSS score is provided, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw simply by sending HTTP requests to the scan_qr.php endpoint without any prior knowledge or credentials. The lack of authentication control and the ability to iterate over post IDs make exploitation straightforward.