WP Event Manager Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WP Event Manager plugin for WordPress, affecting versions through 3.1.49. This vulnerability allows for improper control of filenames in include or require statements, which could be exploited to include local files from the server and execute them.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, including sensitive information such as database credentials. Depending on the server configuration, this could allow for a complete takeover of the database.

Remediation

Users of the WP Event Manager plugin are advised to update to the latest version. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.