CVE-2026-41471
Last modified
CVE-2026-41471 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-41471?
How severe is CVE-2026-41471?
How do I fix CVE-2026-41471?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41466ProjeQtor versions 7.0 through 12.4.3 contain a stored cross…5.4
- CVE-2026-41467ProjeQtor versions 7.0 through 12.4.3 contain a stored cross…5.4
- CVE-2026-41468Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-o…9.3
- CVE-2026-41469Beghelli Sicuro24 SicuroWeb does not enforce a Content Secur…5.2
- CVE-2026-4147An authenticated user with the read role may read limited am…4.3
- CVE-2026-41470LIVE555 before 2026.04.22 contains an authorization bypass v…8.2
- CVE-2026-41472CyberPanel versions prior to 2.4.5 contain a stored cross-si…6.1
- CVE-2026-41473CyberPanel versions prior to 2.4.5 contain an authentication…9.1
- CVE-2026-41475BACnet Stack is a BACnet open source protocol stack C librar…9.1
- CVE-2026-41476Deskflow is a keyboard and mouse sharing app. Prior to 1.26…8.8
- CVE-2026-41477Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.…7.8
- CVE-2026-41478Saltcorn is an extensible, open source, no-code database app…9.9
Are you affected by CVE-2026-41471?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST