The vulnerability stems from improper handling of filenames in a PHP include/require statement, allowing a local file to be included at the attacker’s discretion. This permits reading arbitrary files or executing code located on the server, which can compromise the confidentiality, integrity, and availability of the affected site. The weakness maps to CWE‑98, a well‑known class of local file inclusion flaws.

The issue was discovered in the fullworks Display Eventbrite Events plugin, affecting all versions earlier than 6.3. The vendor’s acknowledged affected range is from the earliest version available through the last pre‑6.3 release.

The CVSS score of 7.5 reflects a high severity impact. The EPSS score of less than 1% indicates that, as of the last update, few exploitation attempts have been observed, though the flaw remains viable for attackers with access to the plugin’s include logic. The vulnerability is not listed in the CISA KEV catalog. While the specific attack vector is not detailed in the advisory, the nature of the flaw suggests that an attacker could trigger the inclusion via crafted requests or by manipulating file paths, a scenario inferred from the description rather than explicitly stated.