EUVD-2025-17527CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager allows PHP Local File Inclusion. This issue affects WP Event Manager: from n/a through 3.1.49.
Analysis
Local File Inclusion (LFI) vulnerability in WP Event Manager WordPress plugin versions through 3.1.49 that allows unauthenticated remote attackers to include and execute arbitrary PHP files from the server filesystem. This CWE-98 vulnerability has a CVSS score of 8.1 (High severity) with high impact on confidentiality, integrity, and availability. While the vulnerability requires specific conditions (AC:H), its network accessibility and lack of authentication requirements make it a significant risk for affected WordPress installations.
Technical Context
This vulnerability stems from improper input validation in PHP file inclusion/require statements within the WP Event Manager plugin (CPE: wp:wp_event_manager). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is insufficiently sanitized before being passed to PHP functions like include(), require(), include_once(), or require_once(). The vulnerability allows attackers to manipulate file paths to access and execute local files on the server that would not normally be accessible through the web interface. Unlike Remote File Inclusion (RFI) attacks that require allow_url_include to be enabled, this LFI variant operates entirely within the local filesystem, making it more reliably exploitable across diverse server configurations.
Affected Products
WP Event Manager (through 3.1.49)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today