Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure

Description

The plugin does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.