Local File Inclusion in the WordPress Eventin plugin occurs because file names supplied in PHP include/require statements are not properly validated. The flaw aligns with CWE‑98 and can allow an attacker to read arbitrary files on the server or, if executable code can be supplied, to run code in the web application context. Based on the description, it is inferred that the vulnerability is triggered by crafted requests that influence the inclusion logic, potentially exposing sensitive data or facilitating privilege escalation.

This vulnerability affects the Arraytics Eventin (wp‑event‑solution) WordPress plugin in all releases from the earliest available version through and including 4.0.20. Any WordPress site that has the plugin installed in one of these versions is at risk.

The CVSS score of 7.5 signals moderate‑high severity, while the EPSS score below 1% indicates a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers were inferred to exploit the flaw by sending specially crafted HTTP requests to the plugin’s endpoints that manipulate the include path, potentially reading files such as application configuration or user data, and, if writable directories exist, executing injected PHP code.