An information disclosure vulnerability in the Easy PayPal Events & Tickets plugin for WordPress allows unauthenticated attackers to enumerate and harvest sensitive customer order records.

The plugin contains an authorization bypass flaw in the QR code scanning endpoint via scan_qr.php, allowing unauthenticated attackers to iterate over sequential WordPress post IDs and retrieve order data.

A successful exploit exposes sensitive customer data, including email addresses, PayPal transaction IDs, and purchase details, leading to severe privacy violations and reputational damage. The CVSS score of 7.5 reflects a high severity level due to the complete compromise of confidentiality without requiring user interaction or authentication.

Immediate Action: Update the Easy PayPal Events & Tickets plugin to version 1.4.0 or later as soon as it becomes available from the vendor.

Proactive Monitoring: Monitor server access logs for unusual request patterns targeting the QR code scanning endpoint with sequential post IDs.

Compensating Controls: Deploy a Web Application Firewall rule to block suspicious traffic patterns hitting the vulnerable query parameters used by the plugin.

Public Exploit Available: Yes, a public proof-of-concept exists via the referenced GitHub Gist write-up.

Administrators running the Easy PayPal Events & Tickets plugin must apply the vendor patch immediately upon release. Given the availability of public proof-of-concept material and the unauthenticated nature of the flaw, prioritizing this update is critical to prevent unauthorized access to customer data.