CVE-2026-75963: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in liedekef Events Made Easy

CVE-2026-75963 is a Local File Inclusion vulnerability (CWE-98) in the Events Made Easy WordPress plugin, affecting all versions up to 3.2.5. The flaw exists in the eme_single_event_page_template function, allowing authenticated attackers with contributor or higher privileges to include arbitrary PHP files on the server. This enables execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data. The vulnerability is triggered passively when a visitor loads the affected event page, meaning the attacker does not need to interact beyond initial payload submission.

Successful exploitation allows attackers with contributor-level access or higher to execute arbitrary PHP code on the server. This can lead to full compromise of the web application, including bypassing access controls, unauthorized data access, and remote code execution. The vulnerability is particularly dangerous because the malicious payload executes passively upon page load by any visitor, increasing the risk of widespread impact.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access and above to trusted users only, and monitor for suspicious file uploads or modifications. Avoid uploading PHP files through the application. Follow vendor advisories closely for updates.