The vulnerability CVE-2025-32160 affects the EventON plugin (version ≤ 2.4.1) developed by Ashan Perera. It is caused by improper validation of filenames used in PHP include or require statements, enabling remote file inclusion. This allows an attacker to supply a crafted filename that the application includes and executes, potentially leading to remote code execution. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, leading to full compromise of the system's confidentiality, integrity, and availability. The attacker could potentially execute malicious scripts, access sensitive data, or disrupt service. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor the vendor's communications for updates and apply any official fixes once released. Until then, restricting access to the vulnerable plugin and limiting privileges may reduce risk.