The ovatheme eventlist plugin versions up to 1.9.2 suffer from an improper control of filename in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This allows attackers to potentially include local files on the server, which can lead to code execution or information disclosure. The vulnerability is remotely exploitable over the network without authentication but requires high attack complexity. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of the system, data leakage, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.