CVE-2026-14280
Received Received - Intake

Local File Inclusion in Events Manager WordPress Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal key is subsequently executed via an include_once() call that fires on every admin_init invocation — including unauthenticated admin-ajax.php requests — meaning once the malicious key is stored by an administrator, the inclusion is triggered without any further authentication or capability check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-14280
EUVD
EUVD-2026-65278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
events_manager events_manager to 7.3.7.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Events Manager WordPress plugin up to version 7.3.7.4 has a Local File Inclusion vulnerability in the em_options_save function. Authenticated attackers with admin access can include and execute arbitrary PHP files on the server. This allows them to run malicious code, bypass access controls, steal data, or gain full control of the site.

Detection Guidance

Check for unauthorized PHP file inclusions in WordPress plugins, specifically in the Events Manager plugin. Review server logs for suspicious admin_init or admin-ajax.php requests. Look for unexpected .php file uploads or modifications in the plugin directory.

Impact Analysis

An attacker could upload a malicious PHP file, then trick the server into executing it. This could lead to complete site compromise, data theft, or further attacks on your server. The vulnerability is triggered even without further authentication once the malicious key is stored.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A breach could result in legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Immediately update the Events Manager plugin to the latest version. Remove any unauthorized PHP files in the plugin directory. Restrict administrator-level access to trusted users only. Monitor server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart