CVE-2026-14280: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in netweblogic Events Manager – Calendar, Bookings, Tickets, and more!

CVE-2026-14280 describes a Local File Inclusion vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin up to version 7.3.7.4. The vulnerability arises from improper control of filenames used in include_once() calls within the em_options_save function. An attacker with administrator privileges can store a traversal key that causes arbitrary PHP files to be included and executed on the server. This inclusion triggers on every admin_init event, including unauthenticated admin-ajax.php requests, allowing code execution without additional authentication or capability checks.

An attacker with administrator-level access can execute arbitrary PHP code on the server by including malicious files. This can lead to bypassing access controls, disclosure of sensitive information, and full code execution on the affected server. The vulnerability is significant because the malicious inclusion triggers automatically on admin_init events, including unauthenticated requests, increasing the risk of exploitation after initial compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid uploading or allowing PHP files that could be included maliciously. Follow vendor updates closely for a patch or official mitigation instructions.