CVE-2025-39584
Published: 16 April 2025
Summary
CVE-2025-39584 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Themewinter Eventin. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 20.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-39584 is a PHP Local File Inclusion vulnerability (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Eventin plugin (wp-event-solution) by Arraytics for WordPress, impacting all versions through 4.0.25. The flaw carries a CVSS 3.1 score of 7.5.
An authenticated attacker with network access can exploit the issue under conditions of high attack complexity and without user interaction. Successful exploitation grants the ability to include arbitrary local PHP files, resulting in high impacts to confidentiality, integrity, and availability on the affected WordPress site.
The vulnerability is tracked in the Patchstack database, which identifies the affected plugin versions and links to the corresponding advisory entry for further details on the issue.
EPSS scores remain low, with a current value of 0.0118 and a recorded peak of 0.0241.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11296
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.25.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.