CVE-2026-122085 · Package
NO FIX YET · SEE WHAT TO DO
The Event Tickets Manager for WooCommerce plugin before 1.6.0 has a ticket-transfer feature that skips authorisation and nonce checks. An unauthenticated attacker can move another attendee's guest-checkout ticket to an email address they choose, which sends the ticket PDF containing personal data to them.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 that sell event tickets through WooCommerce guest checkout. Sites on 1.6.0 or later, or without the plugin, are not affected.
Not affected if plugin-1.6.0-or-later, plugin-not-installed
Who cares event-tickets, woocommerce, wordpress
wp plugin get event-tickets-manager-for-woocommerce --field=version1.6.0 or laterThe Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.