CVE-2026-14280 is a Local File Inclusion vulnerability (CWE-98) in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The vulnerability exists in all versions up to and including 7.3.7.4 and is triggered through the em_options_save function. Authenticated attackers with administrator-level access can store a traversal key that is later included and executed via an include_once() call on every admin_init invocation, including unauthenticated admin-ajax.php requests. This allows execution of arbitrary PHP code, potentially bypassing access controls and compromising the server.

An attacker with administrator privileges can execute arbitrary PHP code on the server by exploiting this vulnerability. This can lead to bypassing access controls, unauthorized data access, and full code execution on the affected system. The vulnerability is significant because the malicious inclusion is triggered on every admin_init event, including unauthenticated requests, enabling persistent exploitation after initial compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to admin-ajax.php requests. Avoid uploading or allowing PHP files that could be included maliciously. Follow vendor updates closely for any released patches or official mitigations.