CVE-2024-38716: 
WordPress vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2024-38716) was discovered in Blue Plugins Events Calendar for Google through version 2.1.0. The vulnerability allows PHP Local File Inclusion through improper limitation of pathname to a restricted directory (Patchstack Database).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires low attack complexity, requires low privileges, needs no user interaction, and has a high impact on confidentiality but no impact on integrity or availability (NVD).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents on the screen. Files containing sensitive information, such as database credentials, could potentially be exposed, which might lead to complete database compromise depending on the configuration (Patchstack Database).

The vulnerability requires low attack complexity and low privileges to exploit. An attacker needs to have at least contributor-level access to the WordPress installation to exploit this vulnerability (Patchstack Database).

Users are advised to update to version 3.0.0 or later of the Events Calendar for Google plugin to remediate this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until the fixed version can be installed (Patchstack Database).