Events Manager CVE-2026-14280

Phase 1 (planting) requires a WordPress account with administrator-level privileges or above to invoke the em_options_save function and store the malicious traversal path in the options table - this is a non-default condition requiring prior account compromise or a separate privilege escalation. Phase 2 (triggering) requires no authentication whatsoever: once the key is stored, any HTTP request that causes admin_init to fire - including unauthenticated admin-ajax.php requests - executes include_once() against the stored path. Full escalation to code execution additionally requires that a PHP file be present at a server path the attacker controls, which in default WordPress installations is limited by the media uploader's extension blocklist; sites that block PHP uploads reduce the impact to information disclosure or inclusion of pre-existing server-side PHP files. The critical limiting factor for initial exploitation is administrator credential access; the critical amplifying factor is that the trigger is fully unauthenticated once the key is stored.

The provided CVSS 6.6 score (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the elevated privilege bar - administrator - required to plant the malicious option key, and AC:H captures the dependency on PHP file upload capability for full remote code execution. However, the two-phase attack structure means the real-world risk exceeds what the aggregate score communicates: once the malicious key is stored, execution is triggered unauthenticated on every admin-ajax.php request, meaning account remediation alone does not stop ongoing exploitation. EPSS data was not provided in this dataset, preventing quantitative exploitation probability comparison. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, but the attack chain is mechanically straightforward and derivable directly from the description, reducing time-to-weaponize after an initial admin compromise. Organizations running Events Manager on sites that permit PHP file uploads - whether in shared hosting or self-managed WordPress environments - should treat patching as urgent regardless of the moderate CVSS base score, since the unauthenticated trigger phase removes the usual privilege-gated protection after initial exploitation.

An attacker who has obtained WordPress administrator credentials - via phishing, credential stuffing, or a separate account-takeover vulnerability - submits a path traversal string to the em_options_save function, storing it in the WordPress options database. The attacker also uploads a PHP web shell via the media library to a known server path. From that point, any unauthenticated HTTP request to admin-ajax.php fires admin_init, which calls include_once() against the stored traversal path, executing the web shell and granting persistent, unauthenticated remote code execution on the server. No public exploit code has been identified at time of analysis, but the chain is mechanically derivable from the vulnerability description alone.