Eventer WordPress Plugin Directory Traversal Vulnerability Allowing Arbitrary File Read

A directory traversal vulnerability has been identified in the Eventer plugin for WordPress, affecting all versions through 3.9.7. The issue arises in the eventer_woo_download_tickets() function, where authenticated attackers with Subscriber-level access or higher can exploit the vulnerability to read arbitrary files on the server. This could lead to the exposure of sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary file read on the server, potentially disclosing sensitive information.

Remediation

Users are advised to update the Eventer WordPress plugin to version 3.9.8 or a newer patched version.