This vulnerability (CWE-22) in MagePeople Team Event Manager for WooCommerce allows an attacker to perform path traversal, leading to PHP local file inclusion. This occurs due to improper limitation of pathname inputs to restricted directories. The flaw affects versions through 4.2.1 and can be exploited remotely with low attack complexity and low privileges. The CVSS 3.1 base score is 6.5, reflecting high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to include local files on the server, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin or applying temporary mitigations if any are recommended by the vendor. Monitor official MagePeople Team channels for updates.