PHP CVE-2025-47586

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical flaw in PHP file inclusion mechanisms. The Motors - Events plugin, a WordPress theme/plugin component by StylemixThemes, fails to properly sanitize or validate user-supplied input before passing it to PHP's include() or require() statements. This allows attackers to manipulate file paths to include files from the local filesystem (LFI) or potentially remote sources (RFI). The affected component processes untrusted input (likely via GET/POST parameters or file paths) without adequate validation, enabling traversal attacks (e.g., '../../../etc/passwd') or inclusion of uploaded files containing malicious PHP code. The vulnerability affects StylemixThemes Motors - Events from unspecified early versions through version 1.4.7.