CVE-2025-22508: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in roninwp FAT Event Lite
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2025-22508 affects the roninwp FAT Event Lite plugin for WordPress, specifically versions up to 1.1. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can allow attackers to execute arbitrary code or access sensitive files on the affected server. The CVSS 3.1 base score is 8.1, reflecting high impact across confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score indicates that the impact on confidentiality, integrity, and availability is severe. However, there are no known exploits in the wild currently reported.
Mitigation Recommendations
No official patch or remediation guidance is currently available for this vulnerability. Users of the roninwp FAT Event Lite plugin should monitor the vendor's announcements and apply any future updates promptly. Until a fix is released, consider disabling or removing the plugin if feasible to reduce exposure.
CVE-2025-22508: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in roninwp FAT Event Lite
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2025-22508 affects the roninwp FAT Event Lite plugin for WordPress, specifically versions up to 1.1. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can allow attackers to execute arbitrary code or access sensitive files on the affected server. The CVSS 3.1 base score is 8.1, reflecting high impact across confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score indicates that the impact on confidentiality, integrity, and availability is severe. However, there are no known exploits in the wild currently reported.
Mitigation Recommendations
No official patch or remediation guidance is currently available for this vulnerability. Users of the roninwp FAT Event Lite plugin should monitor the vendor's announcements and apply any future updates promptly. Until a fix is released, consider disabling or removing the plugin if feasible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Patchstack
- Date Reserved
- 2025-01-07T10:22:41.465Z
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 69cd75ede6bfc5ba1df0866a
Added to database: 4/1/2026, 7:45:49 PM
Last enriched: 5/1/2026, 7:27:19 AM
Last updated: 5/21/2026, 6:35:07 PM
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.