High severity7.5NVD Advisory· Published May 4, 2026· Updated May 26, 2026

CVE-2026-41471

Description

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Easy Paypal Events Ticketsreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4
Package: https://wordpress.org/plugins/easy-paypal-events-tickets

Patches

Vulnerability mechanics

References

gist.github.com/4lec4st/9fd04b4bfadb3f7e388f61588f5f2564nvd
wordpress.org/plugins/easy-paypal-events-tickets/nvd
www.vulncheck.com/advisories/easy-paypal-events-tickets-information-disclosure-via-qr-code-endpointnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000