The Themify Event Post plugin for WordPress versions up to 1.3.2 suffers from a PHP Local File Inclusion vulnerability due to improper validation of filenames used in include or require statements. This weakness can be exploited remotely over the network by an attacker with low privileges without requiring user interaction, potentially allowing full compromise of the affected system. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the Themify Event Post plugin. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data and disruption of service. The high CVSS score indicates significant risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the Themify Event Post plugin if feasible to prevent exploitation. Monitor for updates from the vendor or trusted security sources for a patch or official mitigation instructions.