This vulnerability in Bastien Ho Event post plugin arises from improper validation of filenames used in PHP include or require statements, enabling remote file inclusion. The affected versions are up to 5.9.5. The CVSS 3.1 score is 7.5 (high), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability. No patch or remediation information is provided in the available data.

Successful exploitation could allow an attacker to include and execute remote malicious PHP code, leading to unauthorized disclosure of sensitive information. The CVSS vector indicates a confidentiality impact but no integrity or availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.