The Event Tickets Manager for WooCommerce plugin contains a ticket‑transfer endpoint that does not verify user authorization or validate a nonce. An unauthenticated attacker can invoke this endpoint to transfer another attendee’s guest‑checkout ticket to any email address they choose. The original ticket is invalidated, and the PDF containing the victim’s personal details is sent to the attacker, resulting in privileged data exposure and potential ticket fraud.

WordPress sites using the Event Tickets Manager for WooCommerce plugin, any version older than 1.6.0, are affected.

Because the endpoint is publicly reachable without authentication and lacks nonce protection, exploitation requires only a simple HTTP request; no preparation or privileged access is needed. While no EPSS score is provided and the vulnerability is not listed in CISA KEV, the potential to disclose personal information and to fraudulently transfer tickets makes the risk significant. Immediate mitigation is warranted.