Local File Inclusion Vulnerability in Events Made Easy Plugin

The Events Made Easy plugin for WordPress, in versions up to and including 3.2.5, contains a Local File Inclusion (LFI) vulnerability within the eme_single_event_page_template function. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject paths into the template parameter, resulting in the inclusion and execution of arbitrary .php files located on the server. Because the payload is stored and triggered passively when a user visits the compromised single-event page, this flaw can be leveraged for unauthorized data access, access control bypass, or remote code execution. Defenders should prioritize patching, as this vulnerability requires only minimal privileges to exploit and results in potential server-side code execution.

Impact

Successful exploitation allows for arbitrary code execution in the context of the web server process. Attackers can bypass WordPress access controls, potentially exfiltrate sensitive site configuration data, or gain a foothold for further lateral movement within the hosting environment. This vulnerability affects all installations using versions 3.2.5 and older.

Recommendation

• Update the Events Made Easy plugin to the latest patched version to remediate CVE-2026-75963.
• Audit WordPress user accounts with 'contributor' privileges or higher to ensure authorization integrity.
• Review web server logs for suspicious POST requests to the plugin's event management endpoints that contain directory traversal patterns (e.g., ../) in template parameters.