Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-9765

CWE-552 — Files Accessible to External Parties4 documents4 sources
Severity
6.5MEDIUM
EPSS
4.6%
top 10.75%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown EKC Tournament ManagerLukashuser EKC Tournament Manager
Timeline
PublishedMay 15

Description

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability↗2025-05-15
▶
GHSA
GHSA-vr72-pg8g-8362: The EKC Tournament Manager WordPress plugin before 2↗2025-05-15
▶

💥Exploits & PoCs

1
Nuclei
EKC Tournament Manager WordPress plugin - Path Traversal
▶