CVE-2024-7149 is a high severity (CVSS 8.8) local file inclusion in the Eventin plugin for WordPress, in all versions up to and including 4.0.8. Authenticated users with Contributor access or above can include and run files on the server. Update to a release newer than 4.0.8.
What's affected
The plugin is "Event Manager, Events Calendar, Tickets, Registrations, Eventin" (slug wp-event-solution, from Themewinter). The record says all versions up to and including 4.0.8 are affected, through several style parameters used by its widgets.
The record points to a WordPress plugin repository changeset (3157415) and to source lines in the events, event tabs, schedule list, schedule and speakers widgets. We could not load the changeset page, so we cannot confirm from the advisory text which release carries the fix. A 4.0.9 tag exists in the plugin repository, and releases have continued well past it, so move to the current release and read the plugin changelog to confirm.
How to check if you're exposed
In the WordPress admin, open Plugins and read the Eventin version. 4.0.8 or earlier is affected.
With WP-CLI, run wp plugin list --name=wp-event-solution --fields=name,version,status. Update with wp plugin update wp-event-solution.
Also check who can log in. The attack needs at least a Contributor account, so list users with the Contributor role or higher using wp user list --role=contributor, and repeat for author, editor and administrator. Any account you do not recognize deserves a closer look.
The free in-browser dependency scan can help with the application dependencies around the site, and the Gold directory entry above tracks the CVE.
What to do now
- Update Eventin to the latest release, which is newer than 4.0.8.
- Review user accounts with Contributor access or higher, and remove ones you do not need. Open registration with a default Contributor role makes this much easier to reach.
- Check the uploads directory for files that should not be there, since the record notes the impact grows when attackers can upload files of types usually considered safe.
- Restrict PHP execution in the uploads directory at the web server level.
- Rotate administrator passwords if you find anything suspicious.
Why it matters
The weakness is path traversal, CWE-22, here appearing as local file inclusion. The plugin builds a file path from a style parameter and includes it. If the value is not restricted to a known list, a user can steer the include toward a file of their choosing. The record states that this can bypass access controls, expose sensitive data, or reach code execution where images and other safe file types can be uploaded and included.
Contributor is a low bar. Many sites let people register and publish drafts, so the 8.8 score reflects network access, low complexity and no user interaction, with only a low privilege account needed. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and the record does not claim exploitation.
Quick check
Do I need an administrator account to exploit CVE-2024-7149?
No. The record says Contributor level access and above is enough.
Which version fixes it?
Versions up to and including 4.0.8 are affected. Update to the latest release and confirm in the plugin changelog.
Sources
- WordPress plugin repository changeset 3157415 (referenced by the record; the page did not load for us)
- Safeguard Gold entry for CVE-2024-7149
Last reviewed: 19 October 2026.
