The Events Manager plugin contains a vulnerability in the em_options_save function that allows an authenticated user with administrator privileges or higher to store a malicious array key in the dbem_data[updates] input. When that key is saved, the plugin later executes an include_once() call during every admin_init hook even when the request is unauthenticated, such as through admin-ajax.php. This enables the attacker to include and run arbitrary .php files on the server, thereby bypassing access controls, exfiltrating data, or executing malicious code on the host. The flaw is a classic Local File Inclusion that can be leveraged for complete control of the affected WordPress installation if file upload permissions allow PHP files to be placed on the server.

All installations of the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin up to and including version 7.3.7.4 are affected. The weakness is present in the em_options_save handler and affects the plugin’s admin interface. Only administrators or higher privileges can trigger the vulnerability.

The CVSS score of 6.6 indicates a moderate severity. EPSS data is not available, so the current exploitation likelihood remains unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need administrator-level access to inject the malicious key, but once stored, the inclusion is triggered on every admin_init, including unauthenticated Ajax calls, giving the attacker persistence even without ongoing authentication. Consequently, the impact is significant if a malicious PHP file can be uploaded or otherwise formed on the host.