# Quick Event Manager <= 9.18 - Unauthenticated Payment Bypass via Registration Form and PayPal IPN Handler

- **ID:** WPSEC-2026-1867
- **Plugin:** Quick Event Manager (`quick-event-manager`), https://wordpress.org/plugins/quick-event-manager/
- **Affected versions:** all versions before 9.19
- **Fixed in:** 9.19 (Update to 9.19 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quick-event-manager
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1867/

## Description

The Quick Event Manager plugin for WordPress is vulnerable to Payment Bypass via the registration form and the PayPal IPN callback in all versions up to, and including, 9.18. This is due to the plugin storing a client-supplied 'ipn' value as the registration's payment status, skipping PayPal verification in the IPN callback whenever a 'debug' parameter is present, and not checking verified notifications against the payment status, merchant account, currency or amount. This makes it possible for unauthenticated attackers to have unpaid event registrations recorded as paid.

## References

- https://wpsec.com/vuln/WPSEC-2026-1867/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/
- https://wordpress.org/plugins/quick-event-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1867/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.