The vulnerability CVE-2025-47510 exists in the fullworks Display Eventbrite Events plugin for WordPress, where improper control of the filename parameter in PHP include or require statements allows for local file inclusion. This can enable an attacker with limited privileges to include arbitrary local files, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue affects versions before 6.3. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially exposing sensitive information, modifying application behavior, or causing denial of service. The high CVSS score indicates significant risk to confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and consider disabling it if possible. Monitor for updates from the vendor or trusted security sources.