The plugin "Events Made Easy" for WordPress contains a local file inclusion flaw in the eme_single_event_page_template function exposed to users with contributor‑level or higher permissions. An attacker can store a path traversal payload that causes the plugin to include and execute arbitrary .php files on the server. This enables bypassing file access controls and running any PHP code present on the host, thereby creating a local code execution vector. The weakness is exemplified by CWE‑98. The stored payload is triggered automatically whenever a page that relies on the affected function is viewed, so no additional attacker interaction is needed beyond the initial insertion of the payload.

All installations of the Events Made Easy plugin up to and including version 3.2.5 are vulnerable. The flaw affects WordPress sites that have installed the plugin and grant at least contributor permissions to users.

The vulnerability carries a CVSS score of 7.5, indicating a high risk level. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, but the attack can be performed by any authenticated contributor or higher user and triggers passively when a visitor loads the impacted single‑event page. Because the exploit does not require special host conditions beyond file upload capabilities, the overall risk to environments with contributor accounts is high.