CVE-2026-41471: CWE-639 Authorization Bypass Through User-Controlled Key in Scott Paterson easy-paypal-events-tickets
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers. This plugin was officially closed as of 2026-03-18.
AI Analysis
Technical Summary
CVE-2026-41471 is an authorization bypass vulnerability (CWE-639) in the Easy PayPal Events & Tickets WordPress plugin (version 1.3 and earlier). The vulnerability exists in the scan_qr.php endpoint, which does not properly restrict access to customer order records. Attackers can enumerate sequential WordPress post IDs to retrieve all stored orders without authentication. This results in a high-severity information disclosure risk. The plugin was officially closed on 2026-03-18, and no patch or fix has been provided as of the publication date.
Potential Impact
Exploitation of this vulnerability allows unauthenticated attackers to access and harvest all customer order records stored by the plugin. This leads to a significant information disclosure impacting customer privacy and potentially exposing sensitive order details. There is no indication of privilege escalation or data modification, but the confidentiality of order data is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the plugin was officially closed as of 2026-03-18 and no patch or fix is documented, users should consider discontinuing use of the affected plugin version or removing it entirely. Monitoring vendor channels for any updates or official fixes is recommended.
CVE-2026-41471: CWE-639 Authorization Bypass Through User-Controlled Key in Scott Paterson easy-paypal-events-tickets
Description
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers. This plugin was officially closed as of 2026-03-18.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41471 is an authorization bypass vulnerability (CWE-639) in the Easy PayPal Events & Tickets WordPress plugin (version 1.3 and earlier). The vulnerability exists in the scan_qr.php endpoint, which does not properly restrict access to customer order records. Attackers can enumerate sequential WordPress post IDs to retrieve all stored orders without authentication. This results in a high-severity information disclosure risk. The plugin was officially closed on 2026-03-18, and no patch or fix has been provided as of the publication date.
Potential Impact
Exploitation of this vulnerability allows unauthenticated attackers to access and harvest all customer order records stored by the plugin. This leads to a significant information disclosure impacting customer privacy and potentially exposing sensitive order details. There is no indication of privilege escalation or data modification, but the confidentiality of order data is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the plugin was officially closed as of 2026-03-18 and no patch or fix is documented, users should consider discontinuing use of the affected plugin version or removing it entirely. Monitoring vendor channels for any updates or official fixes is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-20T16:07:47.312Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f8dc9fcbff5d86103c00f1
Added to database: 5/4/2026, 5:51:27 PM
Last enriched: 5/4/2026, 6:06:35 PM
Last updated: 5/5/2026, 5:55:52 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.