Threats tagged 'ghsa-9f68-g44h-hw2f'

The Event Tickets Manager for WooCommerce WordPress plugin versions before 1.6.0 contains a vulnerability in its ticket-transfer feature. This feature lacks proper authorization and nonce validation, allowing unauthenticated users to transfer guest-checkout tickets belonging to other attendees. This unauthorized transfer invalidates the legitimate ticket and causes the victim's ticket PDF, which includes personal attendee data, to be sent to the attacker.