I was acquainted with the person who ran the event and website and let them know about the vulnerability and bought the tickets at the appropriate price after.

I was acquainted with the person who ran the event and website and let them know about the vulnerability and bought the tickets at the appropriate price after. He was also storing passwords as plain text (they would email your password when you clicked "lost password?")... which is pretty troubling for a site that was also taking credit card payments.