CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
Explanation of Vulnerability in Simple Terms
Event Manager for WooCommerce versions up to 4.2.1 contain a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level site access can enumerate and access sensitive files on the server by manipulating file paths. This could expose configuration files, database credentials, or other private data.
What an attacker can do
Read arbitrary files on the server outside the plugin's intended directory.
Potential impact on your site
Sensitive files like wp-config.php or .env may be exposed to authenticated users, risking credential theft.
Conditions required to exploit
Attacker must have a low-privilege account on the WooCommerce site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
