CVE-2026-75963: Events Made Easy Path Traversal Flaw

CVE-2026-75963 Overview

CVE-2026-75963 is a Local File Inclusion (LFI) vulnerability in the Events Made Easy plugin for WordPress. The flaw affects all versions up to and including 3.2.5 and resides in the eme_single_event_page_template function. Authenticated attackers with contributor-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation enables access control bypass, sensitive data disclosure, and code execution when attackers can upload .php files through other means. The stored traversal payload triggers passively when any visitor loads the affected single-event page, so post-submission execution requires no further attacker interaction.

Critical Impact
Contributor-level accounts can achieve server-side PHP code execution through stored path traversal payloads, escalating a low-privilege foothold into full site compromise.

Affected Products

Events Made Easy plugin for WordPress, versions up to and including 3.2.5
WordPress sites permitting contributor-level registration with the plugin enabled
Sites allowing .php file uploads through auxiliary functionality

Discovery Timeline

2026-08-20 - CVE-2026-75963 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75963

Vulnerability Analysis

The vulnerability is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The eme_single_event_page_template function accepts attacker-controlled input that is passed to a PHP include or require operation without proper validation. This allows path traversal sequences to reference arbitrary .php files on the underlying filesystem.

The stored nature of the payload amplifies the impact. An attacker with contributor privileges submits event content containing a traversal string, which is persisted to the database. When any subsequent visitor renders the affected single-event page, the include operation executes with the web server's privileges.

Relevant code paths appear in includes/eme-events.php around line 1721 and includes/eme-fs.php at lines 670 and 842, as referenced in the WordPress Plugin Trac.

Root Cause

The plugin constructs a filesystem path for a PHP include or require statement using values that originate from user-submitted event data. Missing normalization and allowlist validation permit ../ traversal segments and absolute path references, letting attackers pivot to arbitrary .php files on the host.

Attack Vector

Exploitation requires an authenticated contributor account. The attacker submits an event with a malicious template reference containing traversal sequences. When any visitor requests the single-event page, WordPress invokes eme_single_event_page_template, which includes and executes the referenced PHP file. If the site also permits arbitrary .php uploads through other endpoints, the attacker can chain the two capabilities to execute attacker-supplied PHP code and gain remote code execution.

Refer to the Wordfence Vulnerability Report for additional technical detail. No public proof-of-concept code is provided in the referenced advisories.

Detection Methods for CVE-2026-75963

Indicators of Compromise

Requests to single-event page URLs containing directory traversal sequences such as ../ or URL-encoded variants (%2e%2e%2f) in event template parameters
Unexpected inclusion of PHP files outside the plugin directory, such as wp-config.php or files under wp-content/uploads/
New or modified event records containing template field values referencing paths outside wp-content/plugins/events-made-easy/
Contributor-account activity followed by anomalous PHP execution on event pages

Detection Strategies

Review database entries in the Events Made Easy tables for template fields that contain traversal sequences or absolute paths
Correlate contributor-role event submissions with subsequent unusual include/require file access in PHP error logs
Inspect web server access logs for single-event page requests immediately preceded by contributor-role authenticated sessions

Monitoring Recommendations

Enable PHP open_basedir restrictions and log violations to surface out-of-scope file inclusion attempts
Monitor file access telemetry for the web server user reading sensitive files such as wp-config.php from within event rendering flows
Alert on creation or modification of .php files in writable WordPress directories, particularly wp-content/uploads/

How to Mitigate CVE-2026-75963

Immediate Actions Required

Update the Events Made Easy plugin to a version later than 3.2.5 that includes the fix committed in WordPress plugin changeset 3654766
Audit contributor and higher-privileged accounts, disabling any that are unrecognized or inactive
Review all existing event records for traversal payloads in template-related fields and remove malicious content

Patch Information

The vendor addressed the vulnerability in the changeset referenced above. Administrators should upgrade the Events Made Easy plugin through the WordPress admin dashboard or by replacing the plugin files with the patched release. Verify the installed version is greater than 3.2.5 after upgrading.

Workarounds

Temporarily deactivate the Events Made Easy plugin until the patched version is installed
Restrict the contributor role from submitting or editing events by adjusting WordPress capabilities
Configure PHP open_basedir to constrain include operations to the WordPress installation directory
Deploy web application firewall rules that block traversal patterns in requests to Events Made Easy endpoints

bash

# Example open_basedir restriction in php.ini or a site-specific PHP-FPM pool
open_basedir = "/var/www/html/:/tmp/"

# WP-CLI: verify installed plugin version
wp plugin get events-made-easy --field=version

# WP-CLI: update the plugin once a fixed release is available
wp plugin update events-made-easy