EKC Tournament Manager - Arbitrary File Download (CVE-2024-9765)

CVE-2024-9765 is a vulnerability in the EKC Tournament Manager WordPress plugin that allows logged-in administrators to download arbitrary system files outside of the WordPress directory. This flaw could be exploited to access sensitive server files, potentially exposing confidential information and increasing the risk of further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 25th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-9765 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the plugin by sending requests to /wp-admin/admin.php?page=ekc-backup with a backup parameter containing path traversal sequences (e.g., ../../) to download sensitive files such as /etc/passwd.