The vulnerability CVE-2025-47494 in Ashan Perera's EventON plugin arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files or execution of arbitrary code depending on the server configuration. The issue affects EventON versions up to 2.4.1. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed. No patch or official fix details are currently available.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or potentially execute arbitrary code on the server hosting the vulnerable EventON plugin. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable EventON plugin version or applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates and patches.