{"id":"CVE-2026-122085","kind":"vulnerability","aliases":["CVE-2026-122085"],"related":[],"title":"WordPress Event Tickets plugin lets anyone transfer others' tickets and leak attendee data","description":"The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.","summary":"The Event Tickets Manager for WooCommerce plugin before 1.6.0 has a ticket-transfer feature that skips authorisation and nonce checks. An unauthenticated attacker can move another attendee's guest-checkout ticket to an email address they choose, which sends the ticket PDF containing personal data to them.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","woocommerce","wordpress"],"not_affected_if":["plugin-1.6.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of Event Tickets Manager for WooCommerce in the WordPress plugins screen or `wp plugin get event-tickets-manager-for-woocommerce --field=version`\n- Confirm whether the plugin's ticket transfer feature is enabled on the site","fix":"- Event Tickets Manager for WooCommerce: move to `1.6.0` or later","status":"open","published_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:14+00:00","updated_at":"2026-11-08T06:47:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T06:47:14Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets Manager for WooCommerce: move to `1.6.0` or later","reach":"internet","title":"WordPress Event Tickets plugin lets anyone transfer others' tickets and leak attendee data","impact":"medium","summary":"The Event Tickets Manager for WooCommerce plugin before 1.6.0 has a ticket-transfer feature that skips authorisation and nonce checks. An unauthenticated attacker can move another attendee's guest-checkout ticket to an email address they choose, which sends the ticket PDF containing personal data to them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","event-tickets"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attackers reassign tickets and read attendee personal data from PDFs","analyst_note":"","how_to_check":"- Check the installed version of Event Tickets Manager for WooCommerce in the WordPress plugins screen or `wp plugin get event-tickets-manager-for-woocommerce --field=version`\n- Confirm whether the plugin's ticket transfer feature is enabled on the site","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-1.6.0-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 that sell event tickets through WooCommerce guest checkout. Sites on 1.6.0 or later, or without the plugin, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4603,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122085':16A,19A '-2026':15A,18A '1.6.0':34B,82C 'address':62B,117C 'allow':104C 'anoth':52B 'anyon':6A 'attack':49B,142C 'attende':12A,53B,109C,134C 'authoris':43B,86C 'avail':100C 'caus':126C 'check':46B,91C 'checkout':57B,112C 'choos':64B,120C 'contain':70B,133C 'cve':14A,17A 'data':13A,72B,136C 'email':61B,116C 'event':2A,21B,27B,74C 'event-ticket':20B 'featur':40B,97C 'guest':56B,111C 'guest-checkout':55B,110C 'invalid':121C 'leak':11A 'legitim':123C 'let':5A 'manag':29B,76C 'move':51B 'nonc':45B,90C 'other':8A 'packag':23B 'pdf':69B,131C 'perform':85C 'person':71B,135C 'plugin':4A,32B,80C 'send':66B 'sent':139C 'skip':42B 'ticket':3A,9A,22B,28B,38B,58B,68B,75C,95C,113C,124C,130C 'ticket-transf':37B,94C 'transfer':7A,39B,96C,107C 'unauthent':48B,102C 'user':103C 'valid':89C 'victim':128C 'woocommerc':24B,31B,78C 'wordpress':1A,25B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 that sell event tickets through WooCommerce guest checkout. Sites on 1.6.0 or later, or without the plugin, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventtickets","high","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-122085':16A,19A '-2026':15A,18A 'anyon':6A 'attende':12A 'cve':14A,17A 'data':13A 'event':2A 'leak':11A 'let':5A 'other':8A 'plugin':4A 'ticket':3A,9A 'transfer':7A 'wordpress':1A","search_b":"'1.6.0':34B 'address':62B 'anoth':52B 'attack':49B 'attende':53B 'authoris':43B 'check':46B 'checkout':57B 'choos':64B 'contain':70B 'data':72B 'email':61B 'event':21B,27B 'event-ticket':20B 'featur':40B 'guest':56B 'guest-checkout':55B 'manag':29B 'move':51B 'nonc':45B 'packag':23B 'pdf':69B 'person':71B 'plugin':32B 'send':66B 'skip':42B 'ticket':22B,28B,38B,58B,68B 'ticket-transf':37B 'transfer':39B 'unauthent':48B 'woocommerc':24B,31B 'wordpress':25B","search_c":"'1.6.0':82C 'address':117C 'allow':104C 'attack':142C 'attende':109C,134C 'authoris':86C 'avail':100C 'caus':126C 'check':91C 'checkout':112C 'choos':120C 'contain':133C 'data':136C 'email':116C 'event':74C 'featur':97C 'guest':111C 'guest-checkout':110C 'invalid':121C 'legitim':123C 'manag':76C 'nonc':90C 'pdf':131C 'perform':85C 'person':135C 'plugin':80C 'sent':139C 'ticket':75C,95C,113C,124C,130C 'ticket-transf':94C 'transfer':96C,107C 'unauthent':102C 'user':103C 'valid':89C 'victim':128C 'woocommerc':78C 'wordpress':79C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122085","severity":null,"published_at":"2026-11-08T06:17:05+00:00","modified_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}