CVE-2024-7149 Overview
CVE-2024-7149 is a Local File Inclusion (LFI) vulnerability in the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress. The flaw affects all versions up to and including 4.0.8 and stems from insufficient validation of multiple style parameters used by several widgets. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary PHP files present on the server. The issue is tracked under CWE-22 (Path Traversal).
Critical Impact
Contributor-level attackers can execute arbitrary PHP code on the WordPress server, bypass access controls, and access sensitive data by chaining file uploads with the LFI primitive.
Affected Products
- Themewinter Eventin plugin for WordPress (all versions ≤ 4.0.8)
- WordPress sites using the wp-event-solution plugin package
- Sites permitting Contributor-level user registration on vulnerable Eventin versions
Discovery Timeline
- 2024-09-27 - CVE-2024-7149 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7149
Vulnerability Analysis
The Eventin plugin exposes several Elementor-style widgets that render markup based on user-controllable style parameters. These parameters are passed to PHP include-family functions without sanitization, allowing directory traversal sequences to reference arbitrary files on the server. An attacker holding a Contributor account can add or edit content that triggers the vulnerable widget rendering path and force the plugin to include a chosen file. When that file contains PHP, the interpreter executes it in the WordPress process context.
The attack does not require administrative privileges. Any user role permitted to author content invoking the widgets can reach the sinks. When combined with WordPress media upload capabilities that accept image files, an attacker can upload a polyglot file and then include it through the LFI primitive to achieve remote code execution.
Root Cause
The root cause is unsafe use of user-supplied input as a file path argument. The affected widgets—events-tab, events, schedule-list, schedule, and speakers—concatenate the style parameter into a path passed to a PHP include statement. See the vulnerable sinks in tab-1.php, events.php, schedule-list.php, schedule.php, and speakers.php.
Attack Vector
Exploitation is remote over the network via authenticated HTTP requests. An attacker authenticates as a Contributor, then submits a widget configuration containing traversal sequences in a style parameter. The plugin resolves the crafted path and includes the file server-side. Refer to the Wordfence Vulnerability Report for parameter-level details.
Detection Methods for CVE-2024-7149
Indicators of Compromise
- HTTP POST or admin-ajax requests containing traversal sequences such as ../ or encoded variants in style parameters targeting Eventin widget endpoints.
- Unexpected PHP execution originating from uploaded media files in wp-content/uploads/.
- New or modified Contributor accounts followed by widget configuration changes on pages using Eventin shortcodes.
- Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts.
Detection Strategies
- Inspect web server and WordPress access logs for requests to Eventin widget URLs containing style= values with path separators or null bytes.
- Monitor for PHP include, require, or include_once invocations resolving to paths outside plugin directories using runtime application self-protection or PHP audit modules.
- Correlate Contributor-level authentication events with subsequent widget rendering or post-save actions referencing anomalous style values.
Monitoring Recommendations
- Alert on file writes to wp-content/uploads/ immediately followed by HTTP requests referencing the same file path.
- Track plugin version inventory across WordPress fleets and flag any Eventin instance at 4.0.8 or below.
- Baseline expected style parameter values for Eventin widgets and alert on deviations.
How to Mitigate CVE-2024-7149
Immediate Actions Required
- Upgrade the Eventin plugin to version 4.0.9 or later on all WordPress installations.
- Audit user accounts and remove or downgrade Contributor-level accounts that are not strictly required.
- Review recent posts, pages, and widget configurations for suspicious style parameter values or unfamiliar file references.
- Rotate WordPress secrets in wp-config.php and database credentials if exploitation is suspected.
Patch Information
The vendor addressed the issue in the Eventin plugin. Review the fix in WordPress Plugin Changeset 3157415 and update through the WordPress plugin manager or wp-cli.
Workarounds
- Deactivate the Eventin plugin until the patched version can be installed.
- Restrict content authoring roles so that untrusted users cannot obtain Contributor privileges.
- Deploy a web application firewall rule blocking traversal patterns and disallowed characters in Eventin style parameters.
- Set the PHP open_basedir directive to restrict include paths to the WordPress root and required directories.
# Update Eventin via wp-cli
wp plugin update wp-event-solution --version=4.0.9
# Verify installed version
wp plugin get wp-event-solution --field=version
# Optional: harden PHP include scope in php.ini
# open_basedir = /var/www/html:/tmp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
