The FAT Event Lite plugin for WordPress contains an improper control of filename in PHP include/require statements, allowing an authenticated user to cause the plugin to include local files specified by the user. This can expose sensitive filesystem contents or enable an attacker to execute arbitrary PHP code on the server. The weakness is classified as CWE-98, known as Improper Control of Filename for Include/Require Statement.

Any WordPress installation that has installed the FAT Event Lite plugin from vendor roninwp with a version of 1.1 or earlier is vulnerable. The issue applies to all releases in the range listed by the CNA (exactly <= 1.1).

The vulnerability has a CVSS v3.1 score of 7.5, indicating high severity. The EPSS score of 1% shows a very low but non-zero likelihood of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The attack path requires an authenticated user with permission to interact with the plugin, likely a WordPress administrator or editor. Once exploited, an attacker could read or execute local files on the server, potentially leading to full arbitrary code execution.