CVE-2025-30895: Path Traversal in WpEvently WordPress Plugin

The Path Traversal vulnerability in WpEvently allows an attacker to bypass intended access restrictions and include arbitrary files on the server. By manipulating file paths, an attacker can potentially access sensitive configuration files, database credentials, or even source code. Successful exploitation could lead to the disclosure of confidential information, modification of website functionality, or the execution of malicious code on the server. The impact is amplified if the server hosts other sensitive applications or data, enabling potential lateral movement within the network. This vulnerability shares similarities with other Local File Inclusion exploits, where attackers leverage improper input validation to gain unauthorized access.

1. Reserved2025-03-26
2. Published2025-03-27
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-30895 is to immediately upgrade the WpEvently plugin to version 4.2.10 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing a Web Application Firewall (WAF) with rules to block suspicious path traversal attempts (e.g., blocking requests containing '../' sequences), and carefully reviewing and restricting file upload functionalities within the plugin. After upgrading, verify the fix by attempting to access restricted files via the vulnerable endpoint and confirming that access is denied.