The vulnerability identified as CVE-2025-27299 affects WP Asia's MyTicket Events plugin versions up to 1.2.4. It is a path traversal issue caused by improper limitation of pathname inputs, allowing an attacker to potentially access files outside the restricted directory. The CVSS 3.1 base score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and limited confidentiality impact without integrity or availability impact. No patch or vendor advisory is currently provided, and no known exploitation has been reported.

The vulnerability allows an attacker to read files outside the intended directory, potentially exposing sensitive information. There is no indication of integrity or availability impact. The medium severity rating and CVSS score of 5.3 reflect a moderate confidentiality risk. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor WP Asia's communications for updates. Until a fix is released, restricting access to the plugin and limiting exposure to untrusted networks may reduce risk.