This vulnerability (CWE-22) in Blue Plugins Events Calendar for Google allows improper limitation of a pathname to a restricted directory, enabling PHP Local File Inclusion. It affects versions up to 2.1.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official remediation has been published yet, and the product is not a cloud service.

An attacker with privileges can exploit this path traversal vulnerability to include local files via PHP, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for suspicious activity related to file inclusion attempts. Avoid granting unnecessary privileges to users who can interact with the plugin.