CVE-2026-75963

Name of the Vulnerable Software and Affected Versions Events Made Easy versions prior to 3.2.6

Description The Events Made Easy plugin for WordPress contains a Local File Inclusion flaw within the eme single event page template() function. Authenticated attackers with contributor-level access or higher can use the wp page template event property to include and execute arbitrary .php files on the server. This allows for the execution of PHP code, which can be used to bypass access controls or obtain sensitive data. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, requiring no further interaction from the attacker after the initial submission.

Recommendations Update to a version newer than 3.2.5.