Events Made Easy (3.2.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/events-made-easy-3.2.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 20 Aug 2026 07:11:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal File Inclusion Vulnerability in Events Made Easy Pluginhttps://feed.craftedsignal.io/briefs/2026-08-eme-lfi/Thu, 20 Aug 2026 07:11:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-eme-lfi/The Events Made Easy WordPress plugin is vulnerable to authenticated Local File Inclusion via the eme_single_event_page_template function, allowing contributors to execute arbitrary PHP code.The Events Made Easy plugin for WordPress, in versions up to and including 3.2.5, contains a Local File Inclusion (LFI) vulnerability within the eme_single_event_page_template function. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject paths into the template parameter, resulting in the inclusion and execution of arbitrary .php files located on the server. Because the payload is stored and triggered passively when a user visits the compromised single-event page, this flaw can be leveraged for unauthorized data access, access control bypass, or remote code execution. Defenders should prioritize patching, as this vulnerability requires only minimal privileges to exploit and results in potential server-side code execution.

Impact

Successful exploitation allows for arbitrary code execution in the context of the web server process. Attackers can bypass WordPress access controls, potentially exfiltrate sensitive site configuration data, or gain a foothold for further lateral movement within the hosting environment. This vulnerability affects all installations using versions 3.2.5 and older.

Recommendation

  • Update the Events Made Easy plugin to the latest patched version to remediate CVE-2026-75963.
  • Audit WordPress user accounts with 'contributor' privileges or higher to ensure authorization integrity.
  • Review web server logs for suspicious POST requests to the plugin's event management endpoints that contain directory traversal patterns (e.g., ../) in template parameters.
]]>highadvisory