The EventON plugin for WordPress contains an insufficiently validated filename in an include/require PHP construct. A malicious user could manipulate the filename to trigger a local file inclusion, potentially exposing sensitive files or executing arbitrary code on the web server. This flaw falls under CWE-98 and, if exploited, would compromise confidentiality, integrity, and availability of the affected WordPress installation.

Ashan Perera's EventON plugin (EventON Lite) for WordPress. All releases up to and including version 2.4.1 are affected, as well as any earlier versions that are still in use.

The CVSS score of 7.5 indicates high severity. The EPSS score (<1%) reflects a low likelihood of exploitation at present, and the issue is not listed in CISA KEV. The likely attack vector would involve sending a crafted request that causes the plugin to include a local file via an unsanitized parameter, potentially allowing an attacker to read restricted files or execute malicious PHP code.