The vulnerability CVE-2025-32614 in Ashan Perera's EventON plugin (up to version 2.4) arises from improper validation of filenames used in PHP include or require statements. This improper control enables a Local File Inclusion (LFI) attack, where an attacker can cause the application to include and execute local files, potentially leading to code execution or information disclosure. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is published but no patch or official fix has been documented yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files within the context of the vulnerable PHP application, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the serious nature of this impact. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable EventON plugin versions or applying manual code review and hardening to validate and sanitize inputs used in include/require statements. Avoid exposing the application to untrusted users or inputs that could trigger the vulnerability.