CVE-2026-75963 in Events Made Easy Plugin
Summary
by MITRE • 08/20/2026
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The Events Made Easy plugin for WordPress contains a critical Local File Inclusion vulnerability affecting all versions up to and including 3.2.5. This flaw resides within the eme_single_event_page_template function, which is responsible for determining how single event pages are rendered on the website. The core technical issue stems from insufficient input validation when handling file paths or template identifiers provided by users. Instead of strictly validating that the requested resource corresponds to a legitimate, whitelisted template file within the plugin's directory structure, the application accepts arbitrary path inputs without adequate sanitization. This lack of restriction allows an attacker to manipulate the variable used for including files, thereby directing the server to load and execute scripts from outside the intended context.
The vulnerability is classified under CWE-98 Improper Control of Filename for Include/Require Statements in PHP Programs. It requires authenticated access with at least contributor-level privileges or higher to exploit. This privilege requirement means that while a completely anonymous attacker cannot trigger this flaw directly, any user who has registered an account and been granted basic content creation rights can initiate the attack vector. The exploitation mechanism involves submitting a crafted payload containing directory traversal sequences, such as ../..//etc/passwd or similar paths pointing to arbitrary PHP files on the server filesystem. Once submitted, this malicious input is stored within the plugin's database records associated with an event configuration.
The operational impact of this vulnerability is severe due to its passive trigger mechanism. Unlike many other vulnerabilities that require a specific action like clicking a link in an email or visiting a specially crafted URL by the attacker, this flaw executes automatically when any visitor loads the affected single-event page on the website. This means that post-submission execution does not require additional interaction from the attacker after the initial payload storage. As a result, even casual site visitors can inadvertently trigger the inclusion of malicious files simply by browsing to an event page configured with the vulnerable parameters. This significantly lowers the barrier for exploitation and increases the likelihood of successful compromise.
If the server configuration allows it, or if there are other upload vulnerabilities present that allow .php file uploads, this Local File Inclusion can lead to Remote Code Execution. An attacker could include a web shell uploaded via another vector, effectively gaining full control over the underlying operating system. Even without direct code execution, the ability to read arbitrary files on the server enables significant data exfiltration. Attackers can access sensitive configuration files such as wp-config.php to retrieve database credentials, API keys, and other secrets stored in plaintext or weakly encrypted formats within the WordPress installation. This facilitates further lateral movement across the network and compromise of backend systems connected to the compromised application.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Initial Access via Valid Accounts and Defense Evasion through File Manipulation. The use of stored payloads that trigger passively resembles aspects of persistence mechanisms where malicious code is embedded in legitimate-looking data structures. To mitigate this risk, administrators must immediately update the Events Made Easy plugin to a version newer than 3.2.5 where the input validation has been corrected. Until an upgrade is possible, implementing strict Web Application Firewall rules that detect and block directory traversal sequences in POST requests targeting event-related endpoints can provide temporary protection. Additionally, enforcing least-privilege principles for user accounts ensures that only trusted administrators have access to features that interact with file system operations or template configurations. Regular auditing of uploaded files and restricting PHP execution in upload directories are also critical defensive measures to limit the impact if an inclusion attempt succeeds.