An authenticated local file inclusion vulnerability in the Eventin WordPress plugin allows attackers with editor privileges to execute arbitrary PHP code on the underlying server.

This is a path traversal and local file inclusion vulnerability stemming from improper validation of template path settings. The flaw allows an authenticated attacker, specifically users with editor-level access or higher, to include and execute arbitrary local PHP files.

Successful exploitation of this vulnerability permits remote code execution, which poses a severe risk to the integrity and confidentiality of the entire WordPress environment. Given the CVSS score of 7.2, this is classified as a high-severity issue that could lead to full site compromise, unauthorized data access, and potential lateral movement within the hosting infrastructure.

Immediate Action: Update the Eventin WordPress plugin to version 4.1.20 or later immediately.

Proactive Monitoring: Monitor server access logs for unusual requests directed at template files or attempts to access unexpected file paths.

Compensating Controls: Ensure that the WordPress file system permissions follow the principle of least privilege to restrict the ability of the web server user to write to or execute files in sensitive directories.

Public Exploit Available: No (no confirmed public exploit available).

Organizations utilizing the Eventin plugin must prioritize this update to prevent potential site takeovers. Given the high-severity nature of arbitrary code execution, administrators should verify that all instances are patched to version 4.1.20 as soon as possible to mitigate the risk of unauthorized server-side actions.