CVE-2026-121636mediumCWE-345

CVE-2026-121636: medium-severity vulnerability in Quick Event Manager

Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter

Published

Follow this CVE+ Monitor Quick Event Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.1%
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Quick Event Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Quick Event Manager

In the same product, most dangerous first.

CVE-2026-82214MEDIUMQuick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS DownloadEPSS 0.3%