Eventin
CVE-2025-47445
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.This issue affects Eventin: from n/a through 4.0.26.
AnalysisAI
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-23. Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Affected products include: Themewinter Eventin. Version information: through 4.0.26..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform i
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today