PHP Remote File Inclusion Vulnerability in EventON Plugin by Ashan Perera

CVE-2025-47494

What is CVE-2025-47494?

A vulnerability present in the EventON plugin by Ashan Perera allows for PHP Local File Inclusion due to improper control of the filename used in include or require statements. This flaw can enable attackers to manipulate file inclusions, potentially leading to unauthorized access to sensitive files and execution of malicious scripts on the server. The exposed versions, ranging from n/a up to 2.4.1, should be updated promptly to mitigate the risk associated with this vulnerability.

References