CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-10799: Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read
6.5
CVSS
Description
The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Classification
CVE ID: CVE-2024-10799
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
Affected Products
Vendor: imithemes
Product: Eventer - WordPress Event & Booking Manager Plugin
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 21.5% (scored less or equal to compared to others)
EPSS Date: 2025-02-15 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/aea5f970-243f-4642-83e1-34db11c4ca63?source=cvehttps://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534