CVE-2026-14280 netweblogic CVE debrief

Who should care

Administrators of WordPress installations with the Events Manager plugin should assess their exposure and take action to mitigate the vulnerability. This includes verifying the version of the plugin, updating to a patched version if available, and reviewing server logs for suspicious activity. Additionally, administrators should restrict access to the plugin's settings to trusted administrators only and monitor for unusual activity on the server. It is

Why it matters

CVE-2026-14280 allows authenticated attackers with administrator-level access to execute arbitrary PHP code, potentially leading to code execution, access control bypass, and data breaches. Administrators of WordPress installations with the Events Manager plugin should verify their version, update to a patched version if available, and review server logs for suspicious activity.

• Potential code execution on the server
• Possible bypass of access controls
• Potential data breaches through sensitive file inclusion

Technical summary

The Events Manager plugin for WordPress is vulnerable to Local File Inclusion due to a weakness in the em_options_save function. This allows authenticated attackers with administrator-level access to include and execute arbitrary .php files on the server, potentially leading to code execution, access control bypass, and data breaches. The vulnerability can be exploited through the inclusion of malicious .php files, which can be triggered on every admin_init invocation, including unauthenticated admin-ajax.php requests. To mitigate this vulnerability, it is essential to verify the version of the Events Manager plugin and update to a patched version if available. Additionally, reviewing server logs for suspicious

Defensive priority

Administrators of WordPress installations with the Events Manager plugin should verify their version and update to a patched version if available. They should also review their server logs for any suspicious include_once() calls.

Recommended defensive actions

• Verify the version of the Events Manager plugin and update to a patched version if available.
• Review server logs for suspicious include_once() calls.
• Restrict access to the Events Manager plugin's settings to trusted administrators only.
• Monitor for unusual activity on the server.
• Perform regular security audits on the WordPress installation.
• Review and update the incident response plan.
• Ensure that all administrators are aware of the vulnerability and its potential impacts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.6 and severity of MEDIUM. The Events Manager plugin's vulnerability allows for Local File Inclusion, potentially leading to code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.