The flaw lies in the plugin’s handling of filenames used in PHP include or require statements, constituting a CWE‑98 vulnerability. This improper control allows an attacker to force the application to include arbitrary files. Such inclusion can lead to execution of malicious code, data exposure or tampering, and potentially full system compromise if the include can pull in remote code.

WordPress sites that use the Ashan Perera EventON eventon-lite plugin, versions up to and including 2.4.1. Any site installing or running these plugin releases is affected.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score of <1% shows a low probability of widespread exploitation at present, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the likely attack vector involves crafted requests that manipulate the filename parameter, which may be supplied via URLs or form inputs. Successful exploitation would require that the attacker can reach the target site and influence the include path—conditions that are commonly satisfied in public web applications.