CVE-2025-47510: Eventbrite Widget Path Traversal Flaw

CVE-2025-47510 Overview

CVE-2025-47510 is a PHP Local File Inclusion (LFI) vulnerability in the Fullworks Display Eventbrite Events WordPress plugin (widget-for-eventbrite-api). The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can abuse the issue to include arbitrary local files through the plugin's PHP execution path. The vulnerability affects all versions of Display Eventbrite Events up to and including version 6.3. Successful exploitation can lead to disclosure of sensitive server-side files, execution of attacker-controlled PHP, and full compromise of the WordPress site.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially leading to remote code execution and complete compromise of the WordPress host.

Affected Products

Fullworks Display Eventbrite Events WordPress plugin (widget-for-eventbrite-api)
All versions from initial release through version 6.3
WordPress installations with the vulnerable plugin enabled

Discovery Timeline

2025-05-07 - CVE-2025-47510 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47510

Vulnerability Analysis

The vulnerability is classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The plugin accepts attacker-influenced input and passes it to a PHP include, include_once, require, or require_once statement without sufficient validation. An authenticated user can supply a crafted path that resolves to a local file outside the intended directory.

Once included, the file is interpreted as PHP. Attackers can target log files, uploaded media, session files, or other writable locations seeded with PHP code to achieve arbitrary code execution. The issue is exploitable over the network and requires low privileges but high attack complexity.

Root Cause

The root cause is the absence of strict allow-listing on filename parameters consumed by PHP file inclusion functions. User-controlled input flows into an include path without canonicalization, extension validation, or restriction to a fixed base directory. This pattern enables traversal sequences and absolute path references to reach sensitive files on the WordPress host.

Attack Vector

Exploitation occurs over HTTP against a WordPress site running Display Eventbrite Events through version 6.3. The attacker must hold a valid low-privileged account on the target site. The attacker submits a request to the vulnerable plugin endpoint containing a manipulated file path parameter.

The PHP interpreter loads and executes the referenced file. If the attacker can write PHP content to any readable location on the server, this LFI is escalated to remote code execution. The vulnerability mechanism is documented in the Patchstack WordPress Vulnerability Report. No public proof-of-concept code is currently available.

Detection Methods for CVE-2025-47510

Indicators of Compromise

HTTP requests to plugin endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute paths to system files like /etc/passwd.
Unexpected PHP errors in web server logs referencing include(), require(), or failed to open stream for files outside the plugin directory.
New or modified PHP files appearing in WordPress upload directories shortly before plugin requests.
Outbound connections initiated by the PHP process after suspicious requests to the widget-for-eventbrite-api plugin.

Detection Strategies

Inspect WordPress access logs for requests targeting Display Eventbrite Events parameters containing file paths or traversal patterns.
Hunt for anomalous PHP process behavior such as spawning shells, writing files, or making outbound network connections from the web server.
Correlate authentication events with low-privileged accounts followed by requests to plugin endpoints used in file inclusion attempts.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/widget-for-eventbrite-api/ and the WordPress uploads directory.
Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for query and alerting.
Alert on web requests that include directory traversal tokens, null bytes, or php:// and file:// wrappers targeting the plugin.

How to Mitigate CVE-2025-47510

Immediate Actions Required

Upgrade Display Eventbrite Events to a release later than version 6.3 once published by Fullworks.
Audit existing low-privileged WordPress accounts and revoke any unused or unrecognized users.
Review web server and PHP error logs for prior exploitation attempts referencing the plugin.
Restrict file system permissions so the web server process cannot write to directories it can also include from.

Patch Information

Fullworks addresses the vulnerability in versions of widget-for-eventbrite-api released after 6.3. Administrators should confirm the fixed version through the Patchstack WordPress Vulnerability Report and the official plugin changelog before deploying.

Workarounds

Deactivate and remove the Display Eventbrite Events plugin until a patched release is installed.
Place a web application firewall rule in front of WordPress to block path traversal sequences and PHP wrapper schemes in plugin requests.
Set open_basedir in PHP configuration to restrict file inclusion to the WordPress installation directory.
Disable allow_url_include and allow_url_fopen in php.ini to limit inclusion of remote resources.

bash

# Configuration example: restrict PHP file inclusion scope
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Reload PHP-FPM to apply
sudo systemctl reload php-fpm