WP Event Manager plugins up to version 3.1.51 contain a flaw where the filename used in a PHP include statement is not properly validated. This allows an attacker to influence the path of the included file, potentially leading to the inclusion of local or remote files. The vulnerability is identified as CWE‑98. On a compromised system, an attacker can execute arbitrary PHP code or disclose sensitive files, impacting confidentiality, integrity, and availability of the affected WordPress installation.

WordPress sites running the WP Event Manager plugin at any version from the initial release through 3.1.51 are impacted. Sites that have not upgraded past 3.1.51 remain vulnerable.

The CVSS score of 8.1 indicates a high severity. The EPSS score is listed as < 1%, implying a very low probability of exploitation at the time of this analysis. This vulnerability is not included in the CISA KEV catalog. Attackers would likely need local file write or a crafted action that triggers the faulty include. If the include resolves to a remote file, remote code execution could be achieved, but the conditions for such exploitation appear to be limited.