CVE-2024-8671
Published: 24 September 2024
Summary
CVE-2024-8671 is a critical-severity Path Traversal (CWE-22) vulnerability in Exthemes Wooevents. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The WooEvents Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite in all versions through 4.1.2. The flaw stems from insufficient file path validation in inc/barcode.php and is tracked as CWE-22, carrying a CVSS 3.1 score of 9.1.
Unauthenticated attackers can supply crafted paths to overwrite arbitrary files on the server. Successful exploitation can delete critical files such as wp-config.php, resulting in remote code execution on the affected WordPress site.
The Wordfence advisory notes that the issue affects the commercial plugin sold on CodeCanyon and recommends updating once a patched version is released by the vendor.
EPSS for the CVE rose from a low baseline to a peak of 0.1066 on 2025-12-11 before receding to the current value of 0.0863, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49340
Vulnerability details
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated…
more
attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.