Executive brief
The Events Manager WordPress plugin allows administrators to inadvertently store malicious file paths that get automatically executed on every admin page load and unauthenticated admin-ajax requests. Once a malicious path is saved by an admin, any visitor triggering an admin action can cause the server to execute arbitrary PHP code, bypassing normal access controls and enabling data theft or full server compromise.
Technical details
The vulnerability is a Local File Inclusion (LFI) flaw in the em_options_save function that fails to properly validate file paths before storing them in WordPress options. An authenticated administrator can inject a traversal path (e.g., containing ../ sequences) pointing to an uploaded PHP file. The stored path is later executed via include_once() during admin_init hooks, which fire on every admin page load and on unauthenticated admin-ajax.php requests. This means once the malicious key is stored, no further authentication is required—any request that triggers admin_init will execute the included PHP file, allowing arbitrary code execution. The attack chain requires initial administrator access to set the malicious option, but exploitation of the stored payload does not.
Affected products
- Events Calendar The Events Manager up to and including 7.3.7.4
Timeline
- 2026-08-25: disclosed