CVE-2026-122085
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 08, 2026
Vendor
unknown
Description
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.