Directory Traversal Vulnerability in Eventer Plugin for WordPress

CVE-2024-10799

What is CVE-2024-10799?

The Eventer plugin for WordPress is susceptible to a Directory Traversal vulnerability affecting all versions up to and including 3.9.7. This issue arises through the eventer_woo_download_tickets() function, allowing authenticated users with at least Subscriber-level access to exploit it. An attacker can potentially access and read the content of arbitrary files on the server, which could contain sensitive data and lead to further exploitation of the web application. Website administrators are advised to review affected systems and apply patches or updates where applicable.

References