Description
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Eventin | < 4.1.20 | 4.1.20 |
References
- https://wpscan.com/vulnerability/c7bdaa80-a446-4c72-be79-bfc5022a4eca/ exploit vdb-entry technical-description