Path Traversal Vulnerability Affects Event post
CVE-2024-38735

7.5HIGH

Key Information:

Vendor

WordPress
Status
Event Post
Vendor
CVE Published:
12 July 2024

What is CVE-2024-38735?

The vulnerability in the N.O.U.S. Open Useful and Simple Event plugin allows for path traversal, enabling attackers to access unauthorized files on the server through PHP local file inclusion. This weakness affects versions of the Event post plugin up to and including 5.9.5. Malicious actors can exploit this flaw to manipulate file paths, potentially compromising the security of the web application and the server it runs on.

Affected Version(s)

Event post <= 5.9.5

References

https://patchstack.com/database/vulnerability/event-post/...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emili Castells (Patchstack Alliance)
.