The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin contains an arbitrary file read vulnerability (CWE-73) in the proxy_image() function. This flaw allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive data. The vulnerability affects all versions up to 4.0.26. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, credentials, or other private data. This confidentiality breach does not affect integrity or availability directly. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable plugin or disabling it if possible. Monitor for updates from the vendor or WordPress plugin repository to apply patches promptly once available.