CVE-2026-14280 in Events Manager Plugin
Summary
by MITRE • 08/25/2026
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal key is subsequently executed via an include_once() call that fires on every admin_init invocation — including unauthenticated admin-ajax.php requests — meaning once the malicious key is stored by an administrator, the inclusion is triggered without any further authentication or capability check.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in The Events Manager plugin for WordPress represents a critical Local File Inclusion (LFI) flaw affecting all versions up to and including 7.3.7.4. This security issue resides within the em_options_save function, which is responsible for handling configuration updates within the application's administrative interface. While the initial trigger requires an attacker with administrator-level privileges or higher to store a malicious input value, the subsequent exploitation mechanism operates independently of further authentication checks. The core technical flaw lies in how the plugin processes and retrieves stored options, specifically failing to sanitize file paths before passing them to PHP include functions. This lack of proper validation allows for directory traversal sequences to be embedded within configuration parameters, which are then interpreted as valid file paths by the server's runtime environment.
The operational impact of this vulnerability is severe due to its persistence and broad execution context. Once an authenticated administrator inadvertently or maliciously stores a crafted input containing relative path traversals such as ../../wp-config.php, this value remains in the database until explicitly changed. Crucially, the vulnerable code executes via an include_once() call that is invoked during every admin_init hook. This includes requests to unauthenticated endpoints like wp-admin/admin-ajax.php, which are frequently accessed by various plugins and themes for asynchronous operations. Consequently, any user with access to these public-facing administrative AJAX endpoints can trigger the inclusion of the maliciously stored file path without needing to log in or possess elevated privileges at the moment of execution. This effectively downgrades an administrator-only vulnerability into a remote code execution vector accessible to unauthenticated attackers under specific conditions where PHP files can be uploaded and included by other means, such as through media upload features that allow .php extensions.
From a technical perspective, this flaw aligns with CWE-98 Improper Control of Filename for Include/Include Once in PHP, commonly referred to as Local File Inclusion. The vulnerability exploits the application's trust in stored configuration data without verifying its integrity or safety before execution. By leveraging directory traversal characters, an attacker can navigate outside the intended web root or plugin directories to access sensitive system files, such as database configuration scripts containing credentials, core WordPress files for further exploitation, or custom theme functions that may contain additional logic flaws. If the server environment permits the upload and inclusion of PHP files through other vectors, this LFI vulnerability serves as a bridge to achieve arbitrary code execution on the host machine. This capability allows attackers to bypass access controls entirely, exfiltrate sensitive data including database passwords and API keys, or install web shells for persistent backdoor access.
Mitigation strategies must address both immediate remediation and long-term defensive posture. The primary recommendation is to upgrade The Events Manager plugin to a version later than 7.3.7.4 where this vulnerability has been patched by the developers through proper input sanitization and validation of file paths before inclusion. For organizations unable to update immediately, implementing strict Web Application Firewall rules can help detect and block requests containing directory traversal patterns in parameters associated with admin-ajax.php or other administrative endpoints. Additionally, restricting file upload permissions to prevent .php files from being stored in writable directories reduces the potential impact if an attacker attempts to leverage this LFI for code execution. Regular auditing of plugin configurations and limiting administrator account privileges to only those users who strictly require them can also reduce the attack surface by minimizing the number of actors capable of storing malicious traversal keys in the first place.
This incident highlights the importance of secure coding practices regarding dynamic file inclusion, a principle emphasized in industry standards such as OWASP Top 10 under Injection and Broken Access Control categories. The behavior described maps to MITRE ATT&CK techniques involving Server Side Request Forgery or Local File Inclusion depending on the specific exploitation path taken by an adversary. Security teams should treat stored configuration values with the same scrutiny as user input, ensuring that any data retrieved from persistent storage is validated against a whitelist of allowed files before being executed. This approach prevents attackers from abusing trusted application states to compromise system integrity and confidentiality.