CVE-2026-14280: WordPress Events Manager Plugin RCE Flaw

CVE-2026-14280 Overview

CVE-2026-14280 is a Local File Inclusion (LFI) vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress. The flaw affects all versions up to and including 7.3.7.4 and resides in the em_options_save function. An authenticated attacker with administrator-level access can store a path traversal payload that is later executed through an include_once() call on every admin_init invocation, including unauthenticated admin-ajax.php requests. This allows arbitrary .php files on the server to be included and executed. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Once an administrator stores the malicious traversal key, the inclusion fires on every admin request — including unauthenticated ones — enabling PHP code execution without further authentication.

Affected Products

Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress
All versions up to and including 7.3.7.4
Fixed in version 7.4

Discovery Timeline

2026-08-25 - CVE-2026-14280 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-14280

Vulnerability Analysis

The vulnerability exists in the em_options_save function within admin/em-options.php of the Events Manager plugin. The function accepts option values submitted by administrators and persists them without sanitizing path traversal sequences. The stored value is later used as a filename argument in an include_once() call, causing PHP to load and execute the referenced file. Because the inclusion is wired into the admin_init action, it runs on every request to /wp-admin/ endpoints and to admin-ajax.php. WordPress exposes admin-ajax.php to unauthenticated visitors, which converts what would be a post-authentication configuration bug into a code-execution primitive triggerable by any HTTP client after the payload is planted.

Root Cause

The root cause is improper control of a filename passed to a PHP include statement. The plugin trusts administrator-supplied option data as safe input and stores it verbatim, then dynamically constructs an include path from that stored value. Neither a whitelist of allowed files nor sanitization of .. traversal sequences is applied before the include_once() call at the referenced lines in em-options.php.

Attack Vector

An attacker who obtains administrator credentials submits a crafted option value containing a directory traversal sequence pointing to an existing .php file on the filesystem. This includes files uploaded through media libraries, log files with attacker-controlled content saved with a .php extension, or session files. After the option is stored, any subsequent request to admin-ajax.php — including requests without authentication — triggers include_once() against the attacker-controlled path, executing the target file as PHP. The result is arbitrary code execution in the WordPress process context.

The vulnerability mechanism is described in the Wordfence Vulnerability Report and in the source references at em-options.php line 400 and line 405.

Detection Methods for CVE-2026-14280

Indicators of Compromise

WordPress option rows for the Events Manager plugin containing ../ or absolute path fragments in stored values.
Unexpected .php files appearing in the wp-content/uploads/ directory or other web-writable paths.
New administrator accounts created shortly before Events Manager option changes.
Outbound network connections initiated by the PHP-FPM or web server process after admin-ajax.php traffic.

Detection Strategies

Audit the WordPress wp_options table for Events Manager-related keys that contain traversal characters or reference files outside the plugin directory.
Compare installed plugin version against 7.4 using WP-CLI: wp plugin get events-manager --field=version.
Review web server logs for high-frequency, unauthenticated POST requests to admin-ajax.php following administrator option-save activity.
Monitor PHP include/require calls resolving to files outside the plugin's own directory tree.

Monitoring Recommendations

Alert on modifications to Events Manager options originating from unusual IP addresses or user agents.
Baseline the set of .php files inside wp-content/uploads/ and alert on any additions.
Track process execution and outbound network connections spawned by the web server user account to identify post-exploitation activity.

How to Mitigate CVE-2026-14280

Immediate Actions Required

Upgrade the Events Manager plugin to version 7.4 or later on all affected WordPress installations.
Rotate credentials for all WordPress administrator accounts and enforce multi-factor authentication on those accounts.
Inspect the wp_options table for malicious Events Manager entries and delete any option values containing path traversal sequences.
Scan the webroot for unauthorized .php files, particularly in uploads and cache directories.

Patch Information

The vendor addressed the issue in Events Manager version 7.4. Review the WordPress plugin changeset for the specific code changes that remove the unsafe include path handling in em-options.php.

Workarounds

If patching is not immediately possible, deactivate the Events Manager plugin until the upgrade can be performed.
Restrict access to /wp-admin/ and admin-ajax.php at the web server or WAF layer to known administrator IP addresses.
Set the PHP open_basedir directive to limit which filesystem paths PHP can read, reducing the impact of arbitrary inclusion.
Configure the web server to deny execution of .php files inside wp-content/uploads/ and other user-writable directories.

bash

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}