Event Tickets Manager CVE-2026-122085

Exploitation requires the vulnerable Event Tickets Manager for WooCommerce plugin at a version before 1.6.0, with its ticket-transfer feature present (it is exposed to unauthenticated users by default) and at least one target attendee who purchased via guest checkout. The attacker must reference the victim's ticket (CWE-639 user-controlled key), so some knowledge or enumeration of a valid ticket identifier is needed. No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (PR:N/UI:N). Limiting factors: impact is scoped to one attendee's ticket/PDF per request, the target must use guest-checkout tickets, and sites on 1.6.0 or later are not affected.

This is a moderate, prioritise-but-not-emergency issue, consistent with the input Decision label 'this_month'. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction - meaning any unauthenticated remote user can invoke the vulnerable ticket-transfer function against a default install. That raw reachability argues for urgency. However, the other signals temper it: EPSS is only 0.14% (3rd percentile), the vulnerability is NOT on the CISA KEV list, and the PoC is a reference only, not verified as working exploit code. The impact is also bounded - CVSS rates both confidentiality and integrity as Low (C:L/I:L) and availability None, reflecting that each exploitation leaks one attendee's PII-bearing PDF and invalidates one legitimate ticket rather than compromising the server or mass data. This is therefore a genuine privacy/integrity problem (CWE-639, authorization bypass via user-controlled key) that is easy to trigger but low in per-incident blast radius and not currently seeing confirmed active exploitation. Note the CPE vendor is literally 'unknown', so vendor attribution is unconfirmed in the structured data even though the product and fix are identified by WPScan/EUVD.

An unauthenticated attacker sends a crafted request to the plugin's ticket-transfer endpoint, referencing a victim's guest-checkout ticket and specifying an attacker-controlled email address. Because no authorization or valid nonce check is enforced, the plugin reassigns the ticket, invalidating the victim's copy and emailing the attendee's PDF - containing personal data - to the attacker. A public PoC reference exists via WPScan; it is not verified as working exploit code, and the network vector with low complexity (AV:N/AC:L) makes the request trivial to reproduce.