The vulnerability CVE-2025-26964 affects the Arraytics Eventin plugin for WordPress, specifically versions up to 4.0.20. It arises from improper control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical nature of these impacts. However, no known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor trusted security sources and the vendor's communications for updates on patches or official mitigations.