An IDOR vulnerability in the QR endpoint allows unauthenticated attackers to access sensitive order information.
Order IDs are sequential WordPress post IDs and can be enumerated.
GET /?action=add_wpeevent_button_qr&order=1|1|test
4lec4st
🔑
4lec4st
/ CVE-2026-41471.md
Created
May 2, 2026 10:10
CVE-2026-41471 - Information Disclosure via QR Code Endpoint
4lec4st
/ CVE-2026-32834.md
Created
May 2, 2026 10:08
CVE-2026-32834 - Authentication Bypass via QR Code
A vulnerability in the WordPress plugin Easy PayPal Events & Tickets (<= 1.3) allows authentication bypass due to a hardcoded hash validation condition.
The application validates a QR hash using:
if ($hash == $realhash || $hash == 'test')
The presence of the hardcoded value 'test' allows any attacker to bypass authentication.