Events Made Easy <= 3.2.5 Authenticated LFI via wp_page_template (CVE-2026-75963)

Vulnerability Overview Vulnerability Name: Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property CVE ID: CVE-2026-75963 CVSS Score: 7.5 (High) Published Date: August 19, 2026 Last Updated: August 20, 2026 Researcher: Wordfence PRISM - Wordfence Affected Products Affected Versions: Events Made Easy <= 3.2.5 Software Type: Plugin Software Slug: events-made-easy Patched: Yes Fixed Version: 3.2.6 Remediation Recommendation: Upgrade to the patched version 3.2.6 or higher. Vulnerability Description The Events Made Easy plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to 3.2.5. Through the function, attackers can include and execute arbitrary PHP files on the server, thereby bypassing access controls, retrieving sensitive data, or executing code. This vulnerability is passively triggered when visitors load an affected event page and requires no additional attacker interaction. References plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Software Type: Plugin Software Slug: events-made-easy Patched: Yes Recommendation: Upgrade to the patched version 3.2.6 or higher. Affected Versions: <= 3.2.5 Fixed Version: 3.2.6 Related Vulnerabilities Events Made Easy <= 3.1.3 - Missing Authorization - CVE ID: CVE-2026-59557 - CVSS Score: 5.3 - Researcher: HieuPenguinm - Date: July 24, 2026 Events Made Easy <= 2.3.14 - Authenticated (Subscriber+) SQL Injection via 'search_name' - CVE ID: CVE-2023-28640 - CVSS Score: 8.8 - Researcher: Joshua Martinelle - Date: March 20, 2023 Events Made Easy <= 2.3.16 - Missing Authorization - CVE ID: CVE-2023-0404 - CVSS Score: 5.4 - Researcher: Marco Wotschka - Date: December 23, 2022 Events Made Easy <= 2.2.80 - SQL Injection - CVE ID: CVE-2022-1905 - CVSS Score: 9.8 - Researchers: cydaw, Erwan LR - Date: May 27, 2022 Events Made Easy <= 2.2.35 - Subscriber+ SQL Injection - CVE ID: CVE-2021-25030 - CVSS Score: 8.8 - Researcher: Krzysztof Zając - Date: December 6, 2021 Events Made Easy <= 2.2.23 - Admin+ Stored Cross-Site Scripting - CVE ID: CVE-2021-24813 - CVSS Score: 5.5 - Researcher: Huy Nguyen - Date: October 4, 2021 Events Made Easy <= 1.6.20 - Stored Cross-Site Scripting - CVE ID: CVE-2021-24813 - CVSS Score: 6.1 - Researcher: Job Diesveld - Date: August 4, 2016 Events Made Easy <= 1.5.50 - Cross-Site Request Forgery to Stored Cross-Site Scripting - CVE ID: CVE-2021-24813 - CVSS Score: 8.8 - Researcher: David Sopas - Date: October 15, 2015 Footer Information Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Subscribe for news and updates By checking this box, I agree to the terms of service and privacy policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Have you been hacked? Get Help Create Account Sign In View Pricing Disclaimer This record contains copyrighted material Defiant Inc. License MITRE Corporation License Contact For information to add or errors found, please contact wfsupport@wordfence.com Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter Facebook LinkedIn Instagram Additional Information Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today! Want to get notified of the latest vulnerabilities that may affect your WordPress site? Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database. The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API. Buttons Learn More Get Wordfence Documentation

Goal Reached Thanks to every supporter — we hit 100%!

Events Made Easy <= 3.2.5 Authenticated LFI via wp_page_template (CVE-2026-75963)

More from this source