The vulnerability in the ovatheme eventlist plugin involves improper control of filenames used in PHP include or require statements, allowing an attacker to trigger a Local File Inclusion (LFI). This weakness, identified as CWE‑98, enables the inclusion of any file from the server’s filesystem that is reachable through the plugin’s input. If an attacker can supply a crafted path, sensitive files may be read or, in some configurations, code may be executed, giving the attacker full compromise of the application and potentially the host. The vulnerability is present in all released versions through 1.9.2.

WordPress users who have installed the Ovatheme eventlist plugin, any version up to and including 1.9.2. The issue affects every deployment of the plugin within that version range, regardless of other configurations or plugins present.

The CVSS score of 8.1 places the issue in the high severity range, while the EPSS score of less than 1% indicates that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is manipulation of the plugin’s file path parameter, which is typically exposed through a URL or form input. In scenarios where the plugin allows unauthenticated access to that parameter, an attacker could launch the attack directly; otherwise authenticated users could use the LFI to read internal files or execute code if the plugin’s environment permits it.