CVE-2025-22508
Published: 09 January 2025
Summary
CVE-2025-22508 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22508 is an improper control of filename for include/require statement vulnerability, categorized as PHP Remote File Inclusion that permits PHP Local File Inclusion, present in the roninwp FAT Event Lite WordPress plugin. The flaw affects all versions through 1.1 and carries a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can exploit the issue over the network without user interaction, though the attack requires high complexity. Successful exploitation grants the ability to include arbitrary local files, resulting in high impact to confidentiality, integrity, and availability.
The sole referenced advisory from Patchstack describes the flaw as an unauthenticated non-arbitrary local file inclusion vulnerability in the same plugin versions. The EPSS score remains low, moving only from a peak of 0.0294 to a current value of 0.0207.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2789
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in unauthenticated public-facing WordPress plugin directly enables initial access via exploitation of internet-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely identification, reporting, and patching of the PHP Local File Inclusion flaw in the FAT Event Lite WordPress plugin.
Enforces validation of information inputs such as user-supplied filenames in PHP include/require statements, preventing the improper control leading to local file inclusion.
Provides vulnerability monitoring and scanning to identify the LFI vulnerability in the plugin, enabling proactive remediation before unauthenticated remote exploitation.