yucaerin/cve-2025-3419The Eventin plugin (<= 4.0.26) for WordPress contains an unauthenticated arbitrary file read vulnerability
🔥 Vulnerability Summary
The Eventin plugin (<= 4.0.26) for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxy_image() function. Attackers exploit insufficient input validation by manipulating the url parameter to fetch server files (e.g., /etc/passwd, wp-config.php). The function fails to restrict access to local file paths, allowing directory traversal (e.g., ../../). This exposes sensitive data like database credentials, API keys, and system files. The flaw stems from missing sanitization checks before file operations.
🔍 Affected Plugin
🧪 Exploit Features
?action=proxy_image&url=file:///etc/passwd/etc/passwd via keyword root:x:0:0:Apache or Nginx)result.txtpasswd_server_apache.txtpasswd_server_nginx.txt🚀 Usage
Create a list.txt file containing target domains (one per line, without http:// or https://)
example.com
site123.org
Run the script:
python3 cve_2025_3419_checker.py
📁 Output
result.txt: List of sites leaking /etc/passwdpasswd_server_apache.txt: Apache servers vulnerablepasswd_server_nginx.txt: Nginx servers vulnerable🧠 Researcher Credit: DailyCVE
🔒 Disclaimer:
This tool is for educational and authorized testing purposes only. Do not use against targets you do not have permission to assess.