CVE-2025-23915: 
WordPress vulnerability analysis and mitigation

Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (PHP Remote File Inclusion) was discovered in Roninwp FAT Event Lite plugin versions through 1.1. The vulnerability was assigned CVE-2025-23915 and was disclosed on January 16, 2025 (NVD, Patchstack).

The vulnerability is classified as a Local File Inclusion issue with a CVSS v3.1 base score of 7.5 (High). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requiring low privileges (PR:L), no user interaction (UI:N), and affecting only the local scope (S:U). The impact includes high confidentiality, integrity, and availability (C:H/I:H/A:H) (Patchstack).

This vulnerability could allow a malicious actor to include local files of the target website and display their output on the screen. Files containing sensitive information, such as database credentials, could potentially be exposed, which might lead to complete database takeover depending on the configuration (Patchstack).

The vulnerability requires authentication with contributor-level privileges or higher to exploit. The attack complexity is considered high, but the vulnerability has been publicly disclosed (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects FAT Event Lite plugin versions through 1.1 (NVD).