The Eventin plugin for WordPress is vulnerable to Local File Inclusion through the 'style' parameter. This flaw allows authenticated users with Contributor privileges or higher to request the inclusion of any file on the server, enabling the execution of arbitrary PHP code. The resulting compromise can bypass role restrictions, disclose sensitive data, and allow full control over the affected WordPress installation.

WordPress installations running the Eventin – Event Calendar, Event Registration, Tickets & Booking plugin by Arraytics, versions 4.0.24 and earlier.

The flaw carries a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%, suggesting a low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers need valid Contributor credentials to manipulate the 'style' parameter, making the risk primarily focused on sites with a large contributor base. The exploitation path relies on unsanitized input, typical of CWE-22, and can be achieved by submitting a crafted request that points the plugin to a PHP file stored in an upload directory or elsewhere on the server.