What the vulnerability does
01Description
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
Explanation of Vulnerability in Simple Terms
02Summary
Events Made Easy versions 3.2.5 and earlier contain a PHP remote file inclusion vulnerability. An authenticated attacker with low privileges can include and execute arbitrary PHP files from remote servers by manipulating file inclusion parameters. This allows execution of malicious code on the affected site. Update to a version newer than 3.2.5.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site by including files from remote servers.
Potential impact on your site
04Site Impact
Compromised site can serve malware, steal data, or be used to attack visitors and other systems.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
August 20, 2026
CVE published
