{"id":"CVE-2026-121636","kind":"vulnerability","aliases":["CVE-2026-121636"],"related":[],"title":"Quick Event Manager WordPress plugin lets attackers fake PayPal paid registrations","description":"The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.","summary":"The Quick Event Manager WordPress plugin before 9.19 does not check that PayPal payment notifications are genuine before marking event registrations as paid. An unauthenticated attacker can mark registrations as paid without paying.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-registration","package","paypal","wordpress","wordpress-plugin"],"not_affected_if":["paypal-not-used","plugin-9.19-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Quick Event Manager plugin in the WordPress admin plugin list, or in the plugin's main file header.\n- Confirm whether the site uses PayPal payments for event registrations.","fix":"- Quick Event Manager plugin: move to a version at or above `9.19`.","status":"open","published_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:39+00:00","updated_at":"2026-11-06T08:42:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T08:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Quick Event Manager plugin: move to a version at or above `9.19`.","reach":"internet","title":"Quick Event Manager WordPress plugin lets attackers fake PayPal paid registrations","impact":"low","summary":"The Quick Event Manager WordPress plugin before 9.19 does not check that PayPal payment notifications are genuine before marking event registrations as paid. An unauthenticated attacker can mark registrations as paid without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","paypal","event-registration"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unpaid event registrations get marked as paid by outside requests","analyst_note":"","how_to_check":"- Check the installed version of the Quick Event Manager plugin in the WordPress admin plugin list, or in the plugin's main file header.\n- Confirm whether the site uses PayPal payments for event registrations.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","paypal-not-used","plugin-9.19-or-later"],"who_is_affected":"Sites running the Quick Event Manager WordPress plugin before 9.19 that take event registration payments through PayPal. Sites without this plugin or without PayPal payments are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4207,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121636':14A,17A '-2026':13A,16A '9.19':34B,67C 'allow':85C 'attack':7A,52B,87C 'authent':72C 'check':37B 'could':84C 'cve':12A,15A 'event':2A,19B,29B,46B,62C,79C 'event-registr':18B 'fake':8A 'genuin':43B 'let':6A 'make':94C 'manag':3A,30B,63C 'mark':45B,54B,78C,89C 'notif':41B,76C 'packag':21B 'paid':10A,49B,57B,82C,92C 'pay':59B 'payment':40B,75C,96C 'paypal':9A,22B,39B,74C 'plugin':5A,26B,32B,65C 'quick':1A,28B,61C 'registr':11A,20B,47B,55B,80C,90C 'unauthent':51B,86C 'verifi':70C 'without':58B,93C 'wordpress':4A,23B,25B,31B,64C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Quick Event Manager WordPress plugin before 9.19 that take event registration payments through PayPal. Sites without this plugin or without PayPal payments are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventregistration","medium","package","paypal","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-121636':14A,17A '-2026':13A,16A 'attack':7A 'cve':12A,15A 'event':2A 'fake':8A 'let':6A 'manag':3A 'paid':10A 'paypal':9A 'plugin':5A 'quick':1A 'registr':11A 'wordpress':4A","search_b":"'9.19':34B 'attack':52B 'check':37B 'event':19B,29B,46B 'event-registr':18B 'genuin':43B 'manag':30B 'mark':45B,54B 'notif':41B 'packag':21B 'paid':49B,57B 'pay':59B 'payment':40B 'paypal':22B,39B 'plugin':26B,32B 'quick':28B 'registr':20B,47B,55B 'unauthent':51B 'without':58B 'wordpress':23B,25B,31B 'wordpress-plugin':24B","search_c":"'9.19':67C 'allow':85C 'attack':87C 'authent':72C 'could':84C 'event':62C,79C 'make':94C 'manag':63C 'mark':78C,89C 'notif':76C 'paid':82C,92C 'payment':75C,96C 'paypal':74C 'plugin':65C 'quick':61C 'registr':80C,90C 'unauthent':86C 'verifi':70C 'without':93C 'wordpress':64C","first_public_at":"2026-11-06T08:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121636","severity":null,"published_at":"2026-11-06T08:17:20+00:00","modified_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}