The vulnerability is an improper control of the filename used in an include/require statement within the WordPress FAT Event Lite plugin. This flaw, known as a Local File Inclusion, likely permits an attacker to cause the plugin to include files from the local filesystem without authentication. Based on the description, it is inferred that failing to properly validate or sanitize user‑supplied filenames may expose confidential files or enable code execution if a malicious PHP file is served. The weakness is classified as CWE-98.

WordPress installations that have the FAT Event Lite plugin version 1.1 or earlier are affected. The plugin is distributed by the vendor RoninWP under the product name FAT Event Lite.

The issue carries a CVSS score of 8.1 and an EPSS score of <1%, indicating a moderate yet non‑negligible likelihood of exploitation. Attackers can exploit the flaw via unauthenticated requests to the plugin’s inclusion endpoint; based on the description, it is inferred that including attacker‑controlled PHP code could lead to remote code execution. The vulnerability is not listed in CISA’s KEV catalog, but its high severity and unauthenticated nature warrant prompt remediation.