CVE-2024-9765

Deeper analysis

The EKC Tournament Manager WordPress plugin before version 2.2.2 is affected by a vulnerability that permits a logged-in administrator to download system files residing outside the WordPress directory. The issue carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and low privileges required, resulting in high confidentiality impact while leaving integrity and availability unaffected.

An authenticated administrator can exploit the flaw over the network to retrieve arbitrary files from the underlying operating system, potentially exposing configuration data, credentials, or other sensitive information stored outside the web root.

The referenced WPScan advisory identifies the affected plugin versions and indicates that updating to 2.2.2 or later resolves the issue.

The EPSS score rose from a low starting point to a peak of 0.0716 on 2026-03-11 before receding to the current value of 0.0461, signaling that exploitation interest emerged after disclosure.