The vulnerability is an improper control of the filename used in an include/require statement within the WordPress FAT Event Lite plugin. This flaw, known as a Local File Inclusion, permits an attacker to cause the plugin to include files from the local filesystem without authentication. The weakness is classified as CWE-98, indicating that the application fails to properly validate or sanitize user-supplied filenames before inclusion, potentially exposing confidential files or enabling code execution if a malicious PHP file is served.

WordPress installations that have the FAT Event Lite plugin version 1.1 or earlier are affected. The plugin is distributed by the vendor RoninWP under the product name FAT Event Lite.

The issue carries a CVSS score of 8.1 and an EPSS score of 2%, indicating a moderate yet non‑negligible likelihood of exploitation. Attackers can exploit the flaw via unauthenticated requests to the plugin’s inclusion endpoint, potentially reading sensitive files or, in some cases, leading to remote code execution if attacker‑controlled PHP code is included. The vulnerability is not listed in CISA’s KEV catalog, but its high severity and unauthenticated nature warrant prompt remediation.