CVE-2026-122085: Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure

Q: Who is exposed to exploitation?

Sites using Event Tickets Manager for WooCommerce versions before 1.6.0 are affected. The ticket-transfer feature is reachable by unauthenticated users, so an attacker does not need a WordPress account.

Q: What does an attacker need to do to exploit this issue?

An attacker can use the ticket-transfer feature without authorization or a valid nonce check to transfer another attendee's guest-checkout ticket to an email address they control. The transfer invalidates the legitimate ticket and causes the ticket PDF to be sent to the attacker.

Q: What information or impact can result from a successful attack?

The attacker receives the victim's ticket PDF, which contains attendee personal data. The legitimate attendee's ticket is invalidated, potentially preventing its use.

Q: How can I determine whether my site is affected?

Check whether Event Tickets Manager for WooCommerce is installed and whether its version is earlier than 1.6.0. Also review whether guest-checkout tickets and the ticket-transfer feature are in use, as the described attack targets those tickets.

Published Nov 8, 2026

Updated

The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to exploitation?

Sites using Event Tickets Manager for WooCommerce versions before 1.6.0 are affected. The ticket-transfer feature is reachable by unauthenticated users, so an attacker does not need a WordPress account.

What does an attacker need to do to exploit this issue?

An attacker can use the ticket-transfer feature without authorization or a valid nonce check to transfer another attendee's guest-checkout ticket to an email address they control. The transfer invalidates the legitimate ticket and causes the ticket PDF to be sent to the attacker.

What information or impact can result from a successful attack?

The attacker receives the victim's ticket PDF, which contains attendee personal data. The legitimate attendee's ticket is invalidated, potentially preventing its use.

How can I determine whether my site is affected?

Check whether Event Tickets Manager for WooCommerce is installed and whether its version is earlier than 1.6.0. Also review whether guest-checkout tickets and the ticket-transfer feature are in use, as the described attack targets those tickets.

CVE-2026-122085: Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

What information or impact can result from a successful attack?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

What information or impact can result from a successful attack?

How can I determine whether my site is affected?