{
 "id": "WPSEC-2026-1867",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1867/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1867/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1867/index.md",
 "title": "Quick Event Manager <= 9.18 - Unauthenticated Payment Bypass via Registration Form and PayPal IPN Handler",
 "description": "The Quick Event Manager plugin for WordPress is vulnerable to Payment Bypass via the registration form and the PayPal IPN callback in all versions up to, and including, 9.18. This is due to the plugin storing a client-supplied 'ipn' value as the registration's payment status, skipping PayPal verification in the IPN callback whenever a 'debug' parameter is present, and not checking verified notifications against the payment status, merchant account, currency or amount. This makes it possible for unauthenticated attackers to have unpaid event registrations recorded as paid.",
 "plugin": {
  "slug": "quick-event-manager",
  "name": "Quick Event Manager",
  "full_name": "Quick Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/quick-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-event-manager"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.19",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.19"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.19",
 "remediation": "Update to 9.19 or later.",
 "fix_released": "2026-10-27T19:03:52+00:00",
 "published": "2026-10-28T19:48:30+00:00",
 "updated": "2026-10-28T09:11:54.258517+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1867/",
  "https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/",
  "https://wordpress.org/plugins/quick-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}