An authentication bypass vulnerability in the Easy PayPal Events & Tickets plugin for WordPress allows unauthenticated attackers to retrieve sensitive customer and transaction data.

This is an authentication bypass vulnerability stemming from the use of hardcoded credentials, specifically allowing an unauthenticated remote attacker to bypass hash verification by supplying a hardcoded test value.

A successful exploit exposes sensitive customer data, including PayPal transaction IDs, email addresses, purchase amounts, and ticket information for orders with known or guessed post IDs. This can lead to severe privacy violations, potential financial fraud, and loss of customer trust. The assigned CVSS score of 7.5 reflects a high severity risk due to the lack of authentication required to access sensitive transaction details.

Immediate Action: Update the Easy PayPal Events & Tickets plugin to version 1.4.0 or later where the hardcoded validation condition has been removed.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the add_wpeevent_button_qr action parameter, particularly those containing the test string in the hash or order parameter.

Compensating Controls: Deploy a Web Application Firewall rule to block external requests targeting the add_wpeevent_button_qr action if updating the plugin is temporarily unfeasible.

Public Exploit Available: Yes, a public proof-of-concept exists in the referenced GitHub Gist.

Administrators operating vulnerable instances of the Easy PayPal Events & Tickets plugin must apply the vendor patch immediately to prevent unauthorized access to customer and transaction records. Given the availability of a public proof-of-concept, prompt remediation is critical to safeguard organizational data integrity.