CVE-2024-8671 is a critical path traversal vulnerability (CWE-22) in the WooEvents - Calendar and Event Booking WordPress plugin, affecting all versions up to 4.1.2. The vulnerability arises from insufficient validation of file paths in the inc/barcode.php component, enabling unauthenticated attackers to perform arbitrary file overwrite on the server. This can lead to remote code execution by overwriting or deleting critical files such as wp-config.php. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows unauthenticated attackers to overwrite arbitrary files on the affected server, potentially leading to remote code execution. This can compromise the integrity and availability of the system by modifying or deleting critical files such as wp-config.php. The vulnerability poses a critical risk to affected WordPress sites using this plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the WooEvents - Calendar and Event Booking plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.