CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File Inclusion.This issue affects WpEvently: from n/a through <= 4.2.9.
Explanation of Vulnerability in Simple Terms
WpEvently versions 4.2.9 and earlier contain a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. The vulnerability requires network access and high attack complexity but does not require user interaction. An attacker can access sensitive files outside the intended directory structure, potentially exposing configuration files, database credentials, or other protected data.
What an attacker can do
Read, modify, or delete arbitrary files on the server outside the intended application directory.
Potential impact on your site
Sensitive files like wp-config.php, database backups, or private keys could be exposed, modified, or deleted by any authenticated user.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
Related vulnerabilities
