The Arraytics Eventin plugin for WordPress (versions <= 4.0.26) contains a Relative Path Traversal vulnerability. This flaw allows attackers to manipulate file paths to access files outside the intended directory scope. The vulnerability is exploitable remotely without authentication or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No known exploits are reported in the wild. Patch status is not confirmed due to lack of vendor advisory or patch links.

Successful exploitation could allow an attacker to read arbitrary files on the server hosting the vulnerable Eventin plugin, potentially exposing sensitive information. The vulnerability does not impact data integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin files and directories at the web server level to mitigate unauthorized file access. Monitor vendor channels for updates and apply patches promptly once released.