Vulnerabilities / Quick Event Manager / WPSEC-2026-1867
Quick Event Manager <= 9.18 - Unauthenticated Payment Bypass via Registration Form and PayPal IPN Handler
Medium 5.3
CWE-345Fixed in 9.19
- ID
- WPSEC-2026-1867
- Plugin
- Quick Event Manager (quick-event-manager)
- Affected
- all versions before 9.19
- Remediation
- Update to 9.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Quick Event Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Quick Event Manager plugin for WordPress is vulnerable to Payment Bypass via the registration form and the PayPal IPN callback in all versions up to, and including, 9.18. This is due to the plugin storing a client-supplied 'ipn' value as the registration's payment status, skipping PayPal verification in the IPN callback whenever a 'debug' parameter is present, and not checking verified notifications against the payment status, merchant account, currency or amount. This makes it possible for unauthenticated attackers to have unpaid event registrations recorded as paid.
References
- https://wpsec.com/vuln/WPSEC-2026-1867/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/
- https://wordpress.org/plugins/quick-event-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS