CVE-2026-32834 Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning
Unauthenticated attackers can bypass QR code hash verification using a hardcoded value to access sensitive order details in the Easy PayPal Events & Tickets plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32834?
CVE-2026-32834 is a high-severity vulnerability in Scott Paterson easy-paypal-events-tickets, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.
Weakness: CWE-798
Which versions are affected by CVE-2026-32834?
How do I fix CVE-2026-32834?
No fix has been published for CVE-2026-32834 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32834 exists.
Sources
Also known as GHSA-p3hr-535h-p5qw.