CVE-2026-32834 identifies a hardcoded authentication bypass vulnerability (CWE-798) in the Easy PayPal Events & Tickets WordPress plugin prior to version 1.4. The vulnerability exists in the QR code scanning feature, where supplying the hardcoded hash parameter value 'test' allows unauthenticated attackers to bypass hash verification. This enables unauthorized access to sensitive order details via the add_wpeevent_button_qr action endpoint. The CVSS 4.0 base score is 8.7, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality. No patch or official remediation has been published as of the data provided.

Successful exploitation allows unauthenticated remote attackers to retrieve sensitive customer and transaction data, including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information. This compromises confidentiality of order information and could lead to privacy violations or further targeted attacks. There is no indication of integrity or availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable QR code scanning functionality or the add_wpeevent_button_qr action endpoint to prevent unauthorized access. Monitor for vendor updates and apply patches promptly once available.