Local File Inclusion Vulnerability in Eventin Plugin for WordPress

CVE-2024-7149

What is CVE-2024-7149?

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress presents a Local File Inclusion vulnerability in all versions up to and including 4.0.8, which can be exploited through multiple style parameters. Authenticated attackers with Contributor-level access or higher can leverage this vulnerability to include and execute arbitrary files stored on the server. The implications are severe, allowing for potential bypass of access controls, unauthorized access to sensitive data, and code execution through files that could seem benign, such as images and other uploaded file types.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References