CVE-2026-75963 describes a Local File Inclusion vulnerability in the Events Made Easy WordPress plugin (liedekef) affecting all versions up to and including 3.2.5. The flaw exists in the eme_single_event_page_template function, allowing authenticated attackers with contributor-level privileges or above to include arbitrary PHP files on the server. This enables execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data. The exploit is triggered passively when any visitor loads the compromised single-event page, meaning no additional attacker interaction is needed after the malicious file is included.

Successful exploitation allows attackers with contributor-level access to execute arbitrary PHP code on the server, which can lead to full compromise of the WordPress site, including bypassing access controls and accessing sensitive information. The vulnerability is triggered passively by any visitor loading the affected event page, increasing the risk of widespread impact without further attacker action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to event pages. Avoid uploading PHP files or other executable content that could be included via this vulnerability.