Local File Inclusion Vulnerability in Eventin Plugin for WordPress

CVE-2024-7149

What is CVE-2024-7149?

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress presents a Local File Inclusion vulnerability in all versions up to and including 4.0.8, which can be exploited through multiple style parameters. Authenticated attackers with Contributor-level access or higher can leverage this vulnerability to include and execute arbitrary files stored on the server. The implications are severe, allowing for potential bypass of access controls, unauthorized access to sensitive data, and code execution through files that could seem benign, such as images and other uploaded file types.

References