The Eventin WordPress plugin, in versions earlier than 4.1.21, fails to sanitize a template path supplied by users with contributor-level or higher privileges. This allows an attacker to specify the path of any local PHP file on the server, resulting in the plugin including and executing that file. The flaw provides the attacker with the capability to run arbitrary code under the web server’s user context, enabling access to, modification of, or destruction of site data and potential use of the site in further attacks.

All installations of the Eventin WordPress plugin that use a version earlier than 4.1.21 are affected. The plugin is distributed as a WordPress add‑on and can be present on any WordPress site that has it activated. No other products or vendors are listed.

The vulnerability’s severity is serious because local file inclusion can be triggered by any contributor user, granting remote code execution. The EPSS score is not available and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, indicating no widespread public exploitation yet. However, the attack path is still feasible: an attacker must first obtain contributor or higher privileges, or trick such a user into submitting a request that includes the malicious path. Once executed, the attacker can read, modify or delete site content, install malware, or commandeer the site as part of a botnet.