Threats tagged 'ghsa-p3hr-535h-p5qw'

The Easy PayPal Events & Tickets WordPress plugin version 1.3 and earlier contains a hardcoded authentication bypass vulnerability in its QR code scanning feature. This flaw allows unauthenticated remote attackers to bypass hash verification by using the fixed value 'test' as the hash parameter. Exploitation enables attackers to access sensitive order details such as PayPal transaction IDs, customer emails, purchase amounts, and ticket information by targeting the add_wpeevent_button_qr action with a known or guessed post ID. The plugin was officially closed as of March 18, 2026.