WordPress WpEvently Plugin <= 4.2.9 - PHP Object Injection (PHP Object Injection) Schwachstelle

The Path Traversal vulnerability in WpEvently allows an attacker to manipulate file paths, bypassing intended security restrictions. By crafting malicious requests, an attacker can include arbitrary files from the server's filesystem. This could expose sensitive configuration files, source code, or even allow the attacker to execute arbitrary PHP code if they can locate and include a file containing malicious code. The potential impact extends beyond simple data exposure; successful exploitation could lead to complete server compromise and data breaches. This vulnerability shares similarities with other Path Traversal exploits where attackers leverage directory traversal sequences to access unauthorized resources.

Websites using the WpEvently plugin, particularly those running older versions (0.0.0–4.2.9), are at risk. Shared hosting environments are particularly vulnerable as they often have limited access controls and a higher concentration of vulnerable plugins.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/wp-evently/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/wp-evently/../../../../etc/passwd

1. 2025-03-27Disclosure

   disclosure

1. Reserviert2025-03-26
2. Veröffentlicht2025-03-27
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-30895 is to immediately upgrade the WpEvently plugin to version 4.2.10 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing a Web Application Firewall (WAF) with rules to block suspicious path traversal attempts (e.g., blocking requests containing '../' sequences), and carefully reviewing the plugin's code for any other potential vulnerabilities. After upgrading, verify the fix by attempting to access files outside the intended directory structure via the plugin's interface; access should be denied.