The vulnerability in Arraytics Eventin allows an attacker to manipulate the file path used by the plugin’s download routine, resulting in the server serving any file on the filesystem. This path‑traversal flaw, classified as CWE‑23, can expose sensitive files such as configuration files or logs. No evidence in the description suggests privilege escalation or code execution; the impact is limited to disclosure of data that resides on the file system of the host running WordPress.

WordPress sites that install the Arraytics Eventin plugin version 4.0.26 or earlier are affected. All instances of the plugin delivered through the wp‑event‑solution package fall under this risk, regardless of other plugins or WordPress core version.

The CVSS score of 7.5 indicates a moderate to high severity, while the EPSS score of 9% shows a relatively significant likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by targeting the plugin’s download endpoint with a URL that includes a traversal sequence such as ../../../../etc/passwd. The description does not state any authentication or privilege requirement, so the attack is presumed to be possible against public interfaces of the host. If successful, the attacker can obtain arbitrary files, potentially exposing confidential information and compromising site integrity.