Events Made Easy CVE-2026-75963

Exploitation requires an authenticated WordPress account with contributor-level access or higher - unauthenticated exploitation is not possible per the CVSS PR:L metric. The attacker must have the ability to create or edit event posts within the Events Made Easy plugin, which is the standard capability granted to contributors on plugin-enabled sites. The stored payload is triggered passively by any site visitor loading the affected single-event page, so no additional attacker interaction is needed post-submission. Full remote code execution additionally requires that a PHP file be uploadable to a server-accessible path (e.g., via WordPress media upload or another vector), since the LFI includes only files already present on the filesystem; without upload capability, impact is limited to information disclosure from existing PHP files (such as wp-config.php) and access control bypass. Exploitation is scoped to sites running Events Made Easy version 3.2.5 or earlier on any platform.

The CVSS 3.1 score of 7.5 (High) is supported by a vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The AC:H component acknowledges that achieving the RCE-specific impact path requires the ability to upload a PHP file to a server-accessible location in addition to holding contributor access - a meaningful practical constraint. However, the stored, passive-trigger nature of the vulnerability substantially mitigates the UI:N complexity: the attacker's effort ends at event creation, and victim-site visitors inadvertently complete the exploit without any social engineering. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no public exploit code has been identified at time of analysis. Real-world priority is moderate-to-high for WordPress sites where contributors are untrusted or loosely managed, and where file upload permissions exist; it is lower for tightly controlled editorial environments. The limiting factor is the PR:L requirement - mass unauthenticated exploitation is not possible.

An attacker registers or compromises a WordPress account with contributor-level privileges, then creates or edits an event post and injects a path-traversal string (e.g., pointing to an uploaded PHP webshell or a sensitive configuration file) into the single-event page template field. Once the event is published, every subsequent visitor to that event's page passively triggers server-side inclusion and execution of the targeted PHP file - giving the attacker persistent, interaction-free code execution without needing to revisit the site. No public exploit code has been identified at time of analysis, but the Wordfence source-code references provide sufficient detail for a skilled attacker to construct one.