The flaw is an Improper Control of Filename for Include/Require Statement that lets an attacker supply a file path to PHP’s include/require in the Ashan Perera EventON eventon‑lite WordPress plugin. This allows reading of files on the server and, if the attacker can supply content, the potential to execute arbitrary code. The result is a compromise of confidentiality and integrity, and when code execution is achieved, a full server compromise.

WordPress sites that are running the EventON eventon‑lite plugin version 2.4 or earlier, as distributed by Ashan Perera.

The CVSS score of 8.8 classifies the vulnerability as high risk. The EPSS score of 2% indicates a moderate likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that an attacker can trigger the flaw by providing a malicious filename through a web request, suggesting that the attack vector is web‑based and could be unauthenticated or limited to users with access to the plugin’s configuration.