An attacker can cause the Ovatheme Events plugin to include a local file through an unsanitized filename parameter. Based on the description, it is inferred that this improper control of the include/require call allows the plugin to read or execute files on the server, which could potentially expose configuration files or credentials; the ability to trigger code execution is also inferred if a malicious file is placed in the web root.

WordPress sites that have the Ovatheme Events plugin up to and including version 1.2.8 are affected. Any installation of the plugin with version 1.2.8 or earlier is vulnerable.

The vulnerability carries a CVSS score of 8.1, indicating high severity, but its EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack likely requires the attacker to trigger the include path and to have the ability to place or identify a sensitive local file; if achieved, the impact could include plaintext disclosure or code execution on the affected server.