CVE-2025-47494: EventON Path Traversal Vulnerability

CVE-2025-47494 Overview

CVE-2025-47494 is a PHP Local File Inclusion (LFI) vulnerability affecting the Ashan Perera EventON eventon-lite WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. Attackers with low-privileged access can manipulate file path parameters to load arbitrary local PHP files. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress host. The issue affects EventON versions up to and including 2.4.1.

Critical Impact
Authenticated attackers can include arbitrary local files through the EventON plugin, enabling code execution, sensitive file disclosure, and full compromise of the WordPress site.

Affected Products

Ashan Perera EventON (eventon-lite) WordPress plugin versions up to 2.4.1
WordPress sites running vulnerable EventON installations
Hosting environments where PHP file inclusion paths are not restricted

Discovery Timeline

2025-05-07 - CVE-2025-47494 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47494

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion issue in the eventon-lite plugin. The plugin accepts user-controlled input that flows into a PHP include or require statement without sufficient validation or path canonicalization. Attackers supply a manipulated filename or relative path to load arbitrary .php files from the server filesystem. When the included file contains executable PHP, the server interprets it under the WordPress process context. The attack requires low privileges and network access but no user interaction.

Root Cause

The root cause is improper control of filename input passed to a PHP include/require statement [CWE-98]. The plugin does not enforce an allowlist of permitted templates or sanitize directory traversal sequences. Attacker-supplied values reach the inclusion sink directly, allowing path manipulation against the local filesystem.

Attack Vector

An authenticated attacker submits a crafted request to a vulnerable EventON endpoint, providing a manipulated filename parameter. The plugin resolves the path and includes the referenced file. Attackers can target log files, session files, uploaded media, or PHP wrappers to escalate the LFI into remote code execution. The attack complexity is high due to environmental prerequisites for chaining LFI into code execution.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-47494

Indicators of Compromise

HTTP requests to EventON plugin endpoints containing directory traversal sequences such as ../ or encoded variants %2e%2e%2f
Unexpected PHP include/require entries in web server logs referencing files outside the plugin directory
Access patterns to sensitive files like /etc/passwd, wp-config.php, or PHP session paths through plugin URLs
Outbound network connections initiated by the PHP worker process following suspicious plugin requests

Detection Strategies

Inspect web server access logs for query parameters consumed by eventon-lite containing path separators or wrapper schemes such as php://, file://, or data://
Deploy WAF signatures that flag LFI patterns targeting WordPress plugin endpoints
Monitor PHP error logs for failed to open stream or include() failed warnings referencing unexpected paths
Baseline normal EventON request parameters and alert on deviations

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for correlation
Track file integrity on wp-content/plugins/eventon-lite/ to detect tampering
Alert on process creation by the web server user (www-data, apache) spawning shells or scripting interpreters

How to Mitigate CVE-2025-47494

Immediate Actions Required

Identify all WordPress installations running EventON eventon-lite version 2.4.1 or earlier
Disable the EventON plugin until a fixed version is applied if patching is delayed
Restrict administrative and contributor accounts to trusted users since exploitation requires authentication
Review web server and PHP logs for evidence of prior exploitation attempts

Patch Information

A fixed release addressing the LFI must be obtained from the plugin vendor. Consult the Patchstack WordPress Vulnerability Report for the current remediation guidance and update once a patched version above 2.4.1 is available.

Workarounds

Configure PHP open_basedir to restrict file inclusion to the WordPress document root
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent stream wrapper abuse
Deploy a WordPress-aware WAF with rules blocking path traversal and PHP wrapper payloads on plugin endpoints
Apply least-privilege filesystem permissions so the web server cannot read sensitive system files

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"