---
id: CVE-2026-121636
title: >-
  Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification
  Bypass via the 'debug' Parameter
summary: >-
  The Quick Event Manager WordPress plugin before 9.19 does not verify the
  authenticity of PayPal payment notifications before marking event
  registrations as paid, which could allow unauthenticated attackers to mark
  registrations as paid w…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
product: Quick Event Manager
affected:
  - quick_event_manager >= 9.9.5 < 9.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:41:03.685828Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:50:26.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121636'
references:
  - url: 'https://wpscan.com/vulnerability/04b181e1-639c-476f-b66b-2a073bf36829/'
tags:
  - cve.org
ingestedAt: '2026-11-06T07:47:15.873Z'
epss: 0.00114
epssPercentile: 0.01515
---

## Overview

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

## Affected

- `quick_event_manager >= 9.9.5 < 9.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.