Description

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T06:17:32.360Z",
  "pubdate": "2026-08-20T06:17:32.360Z",
  "executiveSummary": "A Local File Inclusion (LFI) vulnerability exists in the Events Made Easy plugin for WordPress in all versions up to, and including, 3.2.5. This security flaw originates from improper input handling within the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access and above to include and execute arbitrary .php files residing on the server.\nThe operational impact of this vulnerability is severe, as successful exploitation facilitates arbitrary PHP code execution, bypass of access controls, and unauthorized retrieval of sensitive system data. In environments where threat actors can upload or introduce arbitrary .php files, this flaw escalates directly to remote code execution.\nA notable characteristic of this vulnerability is the utilization of a stored traversal payload. Once the malicious payload is injected and stored via the vulnerable function, the exploitation is triggered passively whenever an unsuspecting visitor or administrator loads the affected single-event page. Consequently, subsequent execution requires no further active interaction from the attacker, heightening the overall risk profile for web applications utilizing the affected product versions.",
  "technicalDetails": "The vulnerability is localized within the eme_single_event_page_template function of the Events Made Easy plugin for WordPress. Versions up to, and including, 3.2.5 are affected. The root cause stems from insufficient sanitization, validation, and restriction of file path parameters processed by this function, which directly handles template inclusion operations.\nExploitation requires authenticated access with a minimum privilege level of a contributor. The attack flow begins when an attacker with contributor-level permissions submits a crafted request containing a directory traversal and file inclusion payload designed to target the template-loading mechanism handled by the eme_single_event_page_template function.\nBecause the input is not adequately neutralized, the application interprets the supplied traversal sequence as a legitimate file path reference. The payload is subsequently stored within the database or application state associated with the event page. This constitutes a stored traversal payload.\nThe payload behavior manifests passively. When any visitor, regardless of authentication status or privilege level, loads the affected single-event page, the application executes the template inclusion routine. This action forces the server to include and execute the targeted arbitrary .php file specified in the payload.\nPost-exploitation impact includes the execution of arbitrary PHP code under the privileges of the web server process. Depending on server configurations and the presence of file upload capabilities, this allows attackers to achieve full system compromise, bypass existing access controls, and extract sensitive data from the underlying server infrastructure."
}