The WpEvently plugin for WordPress has a security issue in versions up to and including 4.2.9. This means that people with contributor-level access or higher can access and run any files on the server, including ones with PHP code. This could lead to unauthorized access, getting private information, or running code when certain types of files are uploaded.