The vulnerability CVE-2025-39584 affects the Arraytics Eventin WordPress plugin up to version 4.0.25. It involves improper control over the filename parameter in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with network access and low privileges to include local files on the server, potentially leading to arbitrary code execution or data disclosure. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with high attack complexity and no required user interaction.

Successful exploitation of this vulnerability can lead to local file inclusion on the server hosting the Eventin plugin, potentially allowing attackers to read sensitive files, execute arbitrary code, or disrupt service. The impact is rated high due to the potential for full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor the vendor's communications for updates and apply any official fixes once available.