Description
WordPress的wp-event-solution插件存在文件读取漏洞（CVE-2025-47445），攻击者可通过向/wp-admin/admin-ajax.php发送POST请求，构造action=proxy_image和url参数传入路径遍历字符或敏感文件路径（如/etc/passwd），读取服务器上的敏感文件，无需授权即可获取敏感信息。
WordPress wp-event-solution 插件 /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-47445）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-47445
https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-arbitrary-file-download-vulnerability
https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47445.yaml
https://feedly.com/cve/CVE-2025-47445