WP Asia MyTicket Events Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the WP Asia MyTicket Events plugin, specifically in versions through 1.2.4. This vulnerability allows for arbitrary file download, enabling a malicious actor to download any file from the affected website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the website, potentially including login credentials or backup files.

Remediation

Users of the WP Asia MyTicket Events plugin are advised to update to the latest version. Patchstack has issued a virtual patch to mitigate this vulnerability by blocking attacks until an official fix is available.