CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content

`[camptix_private]` hides page content behind a check that the visitor holds a ticket. The check is a "view token" that the plugin both **issues** and **verifies** from data the requester controls:

// plugins/camptix/addons/shortcodes.php:691
public function generate_view_token_for_attendee( $attendee_id ) {
    $email = get_post_meta( $attendee_id, 'tix_email', true );
    $ip    = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '';

    $view_token = md5( 'tix-view-token-' . …