/Vulnerability Library

EventON Lite <= 2.4 - Authenticated Local File Inclusion

CVE-2025-32614
Verified

Description

Ashan Perera EventON contains a PHP remote file inclusion caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires attacker to control include filename.

Severity

High

CVSS Score

8.8

Exploit Probability

2%

Affected Product

flavor

Published Date

April 9, 2026

Template Author

pussycat0x

CVE-2025-32614.yaml
8.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-32614
CWE ID:
cwe-98

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/eventon-lite/eventon-241-authenticated-contributor-local-file-inclusion

Remediation Steps

Update to the latest version of EventON or apply security patches to prevent file inclusion vulnerabilities.