CVE-2026-14280— Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
Quick assessment
Affected
netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Events Manager是WordPress基金会的一款管理活动事件的CMS插件。 WordPress Events Manager 7.3.7.4及之前版本存在代码注入漏洞，该漏洞源于em_options_save函数存在本地文件包含问题，可能导致经过身份验证的攻击者包含并执行服务器上的任意.php文件，从而绕过访问控制、获取敏感数据或实现代码执行。
Possible ATT&CK Techniques 3 AI
T1530 · Data from Cloud Storage T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| netweblogic | Events Manager – Calendar, Bookings, Tickets, and more! | ≤ 7.3.7.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14280
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
Source: CVE Program / CVE List V5
Vulnerability Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal key is subsequently executed via an include_once() call that fires on every admin_init invocation — including unauthenticated admin-ajax.php requests — meaning once the malicious key is stored by an administrator, the inclusion is triggered without any further authentication or capability check.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Events Manager 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Events Manager是WordPress基金会的一款管理活动事件的CMS插件。 WordPress Events Manager 7.3.7.4及之前版本存在代码注入漏洞，该漏洞源于em_options_save函数存在本地文件包含问题，可能导致经过身份验证的攻击者包含并执行服务器上的任意.php文件，从而绕过访问控制、获取敏感数据或实现代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| netweblogic | Events Manager – Calendar, Bookings, Tickets, and more! | 0 ~ 7.3.7.4 | - |
|
II. Public POCs for CVE-2026-14280
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14280
请登录查看更多情报信息。
News Coverage for CVE-2026-14280 (1)
Same Patch Batch · netweblogic · 2026-08-25 · 4 CVEs total
| CVE-2026-15023 | 6.5 MEDIUM | Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parame |
| CVE-2026-17089 | 6.1 MEDIUM | Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter |
| CVE-2026-10627 | 5.3 MEDIUM | Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information D |
IV. Related Vulnerabilities
Same product: Events Manager – Calendar, Bookings, Tickets, and more!
-
CVE-2025-14945
Events Manager - Calendar, Bookings, Tickets, and more! <= 7 -
CVE-2026-17089
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting v -
CVE-2026-10627
Events Manager <= 7.4.0 - Missing Authorization to Unauthent -
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL I -
CVE-2025-12976
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Sto
Same vendor: netweblogic
-
CVE-2025-14945
Events Manager - Calendar, Bookings, Tickets, and more! <= 7 -
CVE-2026-17089
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting v -
CVE-2026-10627
Events Manager <= 7.4.0 - Missing Authorization to Unauthent -
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL I -
CVE-2025-12976
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Sto
Same weakness: CWE-98
-
CVE-2026-66566
WordPress Ambient theme <= 1.7 - Local File Inclusion vulner -
CVE-2026-62115
WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vul -
CVE-2026-62099
WordPress Boutique theme <= 2.3.3 - Local File Inclusion vul -
CVE-2026-62096
WordPress Biolife theme <= 3.2.3 - Local File Inclusion vuln -
CVE-2026-62094
WordPress TechOne theme <= 3.0.3 - Local File Inclusion vuln
V. Comments for CVE-2026-14280
No comments yet