CVE-2026-75963

CVE-2026-75963 is a stored Local File Inclusion in the Events Made Easy WordPress plugin where the traversal payload lives in database records and executes passively on every visitor to the affected event page. The CVSS 7.5 score obscures the true severity: you inject once, then the entire site's traffic becomes an involuntary exploitation engine with no further attacker action required. The contributor-level access threshold is the critical multiplier. WordPress contributor accounts can create draft content and upload media but cannot publish or modify core settings—yet this plugin grants them sufficient access to embed traversal paths in event template fields and achieve arbitrary PHP execution on page load. The gap between contributor privileges and code execution is unusually wide. On high-traffic events sites, contributor access is often granted to external speakers, sponsors, or community partners, expanding the attack surface beyond the WordPress administrator cohort. The EPSS score of 0.00518 appears misaligned with these characteristics, likely because the vulnerable code path (eme_single_event_page_template) is abandoned functionality—still wired into the request pipeline but no longer actively maintained or monitored by security scanners. The 2026 disclosure date further suggests this is a preliminary disclosure not yet fully circulating in threat feeds. Remediation requires two stages most operators will miss. First, patch to version 3.2.6. Second, audit every event template field in your database for traversal payloads already planted—the passive trigger means the exploitation clock started the moment the payload was stored, potentially months before the CVE was published. A site that patches but doesn't audit remains compromised. Check eme_events table fields related to template rendering, particularly any column storing single-event page template selections or custom display preferences.

Reviewed through automated stages and approved by a human before publication.