The Easy PayPal Events & Tickets plugin for WordPress versions prior to 1.4 contains an authorization bypass vulnerability (CWE-639) in its QR code scanning endpoint (scan_qr.php). This flaw enables unauthenticated attackers to enumerate sequential WordPress post IDs and retrieve all customer order records stored in the database. The vulnerability arises because the endpoint does not properly restrict access or validate user permissions, allowing information disclosure of sensitive order data without authentication or prior knowledge of order identifiers.

Attackers can harvest the complete set of customer order records from the affected plugin's database without authentication. This leads to exposure of potentially sensitive customer information and order details. The vulnerability does not require user interaction or privileges, increasing the risk of exploitation. There is no indication of remote code execution or data modification, but the confidentiality of customer order data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to the scan_qr.php endpoint through web server configuration or firewall rules to prevent unauthorized access.