Executive Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to, and including, 4.1.22. This vulnerability allows authenticated attackers with custom-level access and above to include and execute arbitrary .php files on the server, potentially leading to code execution, access control bypass, and sensitive data exposure. The CVSS score for this vulnerability is 7.5, indicating a high severity level.Technical Analysis
The vulnerability is classified as Local File Inclusion (LFI), specifically CWE-98. The attack vector involves the 'event_layout' parameter, which allows an attacker to include arbitrary .php files on the server. The root cause of this vulnerability is the lack of proper input validation and access control in the plugin's handling of the 'event_layout' parameter. An attacker must have at least custom-level access and above to exploit this vulnerability.How It Gets Exploited
An authenticated attacker with custom-level access and above can exploit this vulnerability by manipulating the 'event_layout' parameter to include a malicious .php file. For example, an attacker could send a crafted request to include a malicious PHP file uploaded to the server, potentially achieving arbitrary code execution. The technical steps involve:- The attacker gains access to the WordPress site with custom-level permissions.
- The attacker manipulates the 'event_layout' parameter to include a malicious .php file.
- The server fails to validate the input properly, allowing the inclusion of the malicious file.
- The malicious PHP code is executed, potentially leading to code execution, data exfiltration, or access control bypass.
Impact Assessment
The affected product is the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, specifically all versions up to and including 4.1.22. The potential impact includes arbitrary code execution, bypassing access controls, obtaining sensitive data, and achieving code execution in cases where .php file types can be uploaded and included. The CVSS score of 7.5 indicates a high severity level, with high impacts on confidentiality, integrity, and availability.Recommended Actions
To mitigate this vulnerability, it is recommended to update the Eventin plugin to a version beyond 4.1.22. Additionally, users should ensure that they have proper access controls in place and monitor their WordPress sites for suspicious activity. Implementing a Web Application Firewall (WAF) rule to detect and block suspicious requests to the 'event_layout' parameter can also help prevent exploitation.Sources
- National Vulnerability Database (NVD)- Wordfence