CVE-2026-32834 is a high-severity vulnerability (CVSS 8.7) in the Easy PayPal Events & Tickets WordPress plugin (version 1.3 and earlier) developed by Scott Paterson. The vulnerability arises from the use of hardcoded credentials (CWE-798) in the QR code scanning functionality, specifically allowing bypass of hash verification by supplying a static 'test' value. This enables unauthenticated remote attackers to access sensitive order details via the add_wpeevent_button_qr action endpoint. The plugin has been officially closed as of March 18, 2026, and no patch or official fix has been published.

Exploitation of this vulnerability allows unauthenticated attackers to bypass authentication controls and access sensitive customer and transaction data, including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information. This exposure can lead to privacy violations and potential fraud. The vulnerability affects all installations running version 1.3 or earlier of the plugin. There are no known exploits in the wild at this time.

The plugin has been officially closed as of March 18, 2026, and no official patch or remediation is currently available. Users should discontinue use of the affected plugin version and remove it from their WordPress installations to prevent exploitation. Monitor vendor communications for any future advisories or replacement solutions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.