The vulnerability allows an attacker to manipulate the file path parameter used by the MyTicket Events plugin, enabling them to read arbitrary files from the server's filesystem. This path traversal flaw is classified as CWE‑22. A successful exploitation does not provide code execution but can expose sensitive configuration files, credentials, or other private data, leading to a breach of confidentiality.

The flaw affects WordPress sites that have the MyTicket Events plugin from WP Asia installed in any version up to and including 1.2.4. All users running an affected release are vulnerable because the plugin does not properly limit path traversal attempts.

The CVSS score of 5.3 reflects moderate severity and the EPSS score of less than 1 % indicates a very low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need only a crafted request to the plugin’s file retrieval endpoint, which can be executed remotely by anyone who can access the exposed URL, making the attack straightforward but limited to reading files. The lack of elevation to code execution keeps the overall risk moderate.