CVE-2025-47445 is a high severity relative path traversal flaw (CVSS 7.5) in Eventin, the WordPress plugin with the slug wp-event-solution. Versions through 4.0.26 allow arbitrary file download without a login. Update to version 4.0.27 or later, and rotate any secrets kept in readable files.
What's affected
The record lists Eventin (wp-event-solution) from the earliest version through 4.0.26. Patchstack names 4.0.27 as the patched version and classifies the flaw as an arbitrary file download. It lists the required privilege as unauthenticated.
The vendor shown in the record is Arraytics, also credited under the name Themewinter in the product field. Version 4.0.27 or newer is not affected.
How to check if you're exposed
With WP-CLI, read the installed version.
wp plugin get wp-event-solution --field=version
Or open the Plugins page in the WordPress admin and read the version beside Eventin. A deactivated copy still leaves its files on the server, so do not skip it.
To check many sites at once:
wp plugin list --name=wp-event-solution --fields=name,version,status
Anything at 4.0.26 or below is affected. After you update, run the same command again to confirm that the version changed.
What to do now
- Update Eventin to 4.0.27 or later on every site.
- If you cannot update right away, deactivate and remove the plugin until you can.
- Look in your access logs for requests to the plugin that carry odd file path values, such as many parent directory markers.
- Assume files readable by the web server user could have been downloaded. Consider rotating secrets stored in them, such as database credentials and API keys kept in configuration files.
- Enable automatic updates for plugins on public sites.
Patchstack gives the same first step: update the plugin, and ask your host or developer if you cannot.
Why it matters
The record maps this to CWE-23, relative path traversal. A path supplied by a visitor is joined to a base directory without stopping it from climbing out. The visitor then reads files the plugin was never meant to serve. Patchstack summarises the impact as attackers being able to download private server files and steal secrets like passwords or keys.
The CVSS vector reads as a network attack with low complexity, no privileges and no user interaction, with high impact on confidentiality only. That is why the score is 7.5 and not higher: it reads data but does not change it.
On exploitation, be precise. The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog. Patchstack's page states that it is expected to be exploited and uses a known-to-be-exploited label, but the page does not name a campaign or victim. Treat it as likely to be tried, and patch on that basis.
Secrets in WordPress configuration files are the usual prize for this kind of bug. Moving credentials out of the web root, or restricting file permissions, reduces what a file read can reach.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this change data on my site?
No. The CVSS vector shows high impact on confidentiality and none on integrity or availability. It exposes files for download.
Is there a fixed version?
Yes. Patchstack lists 4.0.27 as the patched version. Update to that or later.
For a quick look at known issues in your own dependency files, try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 18 October 2026.
