Improper limitation of a pathname in the WpEvently plugin allows an attacker to perform a PHP local file inclusion by crafting a path traversal string. This can potentially lead to arbitrary code execution or disclosure of sensitive information. The weakness is identified as CWE‑22, which characterizes untrusted path manipulation.

The WpEvently plugin (mage-eventpress) from any released version through 4.2.9 is affected. This includes installations on WordPress sites that have not upgraded beyond the 4.2.9 release or to a later patched version. The vendor responsible for this plugin is magepeopleteam.

The CVSS score of 7.5 indicates a high severity for this vulnerability. The EPSS score is reported as less than 1%, suggesting that the likelihood of widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to send a specially crafted request to the plugin’s input handling endpoint that does not properly resolve relative paths, or exploit a local file system path that the server can access. The attack vector is therefore likely remote, but it depends on the plugin’s exposed interfaces.