{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/events-made-easy-3.2.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-75963"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Events Made Easy (3.2.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Events Made Easy plugin for WordPress, in versions up to and including 3.2.5, contains a Local File Inclusion (LFI) vulnerability within the \u003ccode\u003eeme_single_event_page_template\u003c/code\u003e function. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject paths into the template parameter, resulting in the inclusion and execution of arbitrary .php files located on the server. Because the payload is stored and triggered passively when a user visits the compromised single-event page, this flaw can be leveraged for unauthorized data access, access control bypass, or remote code execution. Defenders should prioritize patching, as this vulnerability requires only minimal privileges to exploit and results in potential server-side code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the web server process. Attackers can bypass WordPress access controls, potentially exfiltrate sensitive site configuration data, or gain a foothold for further lateral movement within the hosting environment. This vulnerability affects all installations using versions 3.2.5 and older.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Events Made Easy plugin to the latest patched version to remediate CVE-2026-75963.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user accounts with 'contributor' privileges or higher to ensure authorization integrity.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious POST requests to the plugin's event management endpoints that contain directory traversal patterns (e.g., ../) in template parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T07:11:37Z","date_published":"2026-08-20T07:11:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-eme-lfi/","summary":"The Events Made Easy WordPress plugin is vulnerable to authenticated Local File Inclusion via the eme_single_event_page_template function, allowing contributors to execute arbitrary PHP code.","title":"Local File Inclusion Vulnerability in Events Made Easy Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-eme-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Events Made Easy (3.2.5)","version":"https://jsonfeed.org/version/1.1"}