WPMinds Simple WP Events Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WPMinds Simple WP Events plugin, versions through 1.8.17. This vulnerability allows for improper limitation of a pathname to a restricted directory, potentially leading to arbitrary file deletion on the affected WordPress site.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the WordPress installation. If critical core files are removed, it may cause the website to malfunction or become inoperable.

Remediation

Users of the WPMinds Simple WP Events plugin are advised to update to version 1.9.0 or later. Patchstack users can enable auto-updates for vulnerable plugins.