CVE-2024-10799: Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read
The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventerwoodownloadtickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10799?
CVE-2024-10799 is considered a medium severity vulnerability due to potential exposure of sensitive files.
How do I fix CVE-2024-10799?
To fix CVE-2024-10799, update the Eventer plugin to version 3.9.8 or later.
Who is affected by CVE-2024-10799?
CVE-2024-10799 affects users of the Eventer plugin for WordPress prior to version 3.9.8.
What type of attack does CVE-2024-10799 allow?
CVE-2024-10799 allows authenticated attackers with Subscriber-level access to perform Directory Traversal attacks.
What functions are impacted by CVE-2024-10799?
The eventer_woo_download_tickets() function is primarily impacted by CVE-2024-10799.