Skip to content
Sign in
5.3 Medium

CVE-2026-121636 Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

Description

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Quick Event Manager 9.9 9.9.5 → < 9.19 9.19

Other CVEs of Quick Event Manager

The 2 CVEs of Quick Event Manager →
CVE-2026-82214 The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before… 5.3 Medium
Track this CVE