WordPress Plugin Vulnerabilities

Easy PayPal Events & Tickets < 1.4 - Insecure Direct Object Reference to Unauthenticated Information Exposure

Description

The Easy PayPal Events & Tickets plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.3 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view others order details.

Affects Plugins

Plugin icon
easy-paypal-events-tickets
Fixed in 1.4

References

CVE
CVE-2026-41471
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/dd090b6b-e428-4bfa-b3d0-9fb6de92cf9d

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
4lec4st
Verified
No
WPVDB ID
36dc3cb6-b842-4901-ba1f-422bbdd3bb41

Timeline

Publicly Published
2026-05-04 (about 3 months ago)
Added
2026-07-30 (about 24 days ago)
Last Updated
2026-07-30 (about 24 days ago)

Other

Published
Title
Published
2026-07-29
Title
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
Published
2024-01-26
Title
wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR
Published
2024-04-15
Title
Login with phone number < 1.7.17 - Unauthorized Account Password Change to Privilege Escalation
Published
2025-05-06
Title
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
Published
2025-04-23
Title
Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure