CVE-2026-121636: Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

Published Nov 6, 2026

Updated

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Quick Event Manager versions before 9.19 are affected. The issue concerns the plugin's handling of PayPal payment notifications for event registrations.

Does exploitation require an attacker to authenticate or make a PayPal payment?

No. The issue can be exploited by an unauthenticated attacker, who may mark registrations as paid without making a payment.

What should be done to remediate the issue?

Update Quick Event Manager to version 9.19 or later.

CVE-2026-121636: Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an attacker to authenticate or make a PayPal payment?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an attacker to authenticate or make a PayPal payment?

What should be done to remediate the issue?