Description
Event Manager, Events Calendar, Tickets, Registrations – Eventin 是一个用于 WordPress 的插件。该漏洞存在于其 proxy_image() 函数中，允许未经身份验证的攻击者读取服务器上的任意文件内容，可能导致敏感信息泄露。受影响的版本为 4.0.26 及以下版本。
Wordpress Plugin Eventin /wp-admin/admin-ajax.php proxy_image 文件读取漏洞（CVE-2025-3419）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-3419
https://github.com/Yucaerin/CVE-2025-3419
https://www.wordfence.com/blog/2025/05/10000-wordpress-sites-affected-by-arbitrary-file-read-vulnerability-in-eventin-wordpress-plugin/
https://access.redhat.com/security/cve/cve-2025-3419
https://cvefeed.io/vuln/detail/CVE-2025-3419
https://plugins.trac.wordpress.org/changeset/3284545/wp-event-solution/trunk/core/Admin/Hooks.php
https://www.ameeba.com/blog/cve-2025-3419-arbitrary-file-read-vulnerability-in-eventin-plugin-for-wordpress/