CVE-2026-18366

Deferred Deferred - Pending Action

Unauthenticated Privilege Escalation in Events Manager WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18366

EUVD

EUVD-2026-57099

Affected Vendors & Products

Vendor	Product	Version / Range
events_manager	events_manager	to 7.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

The Events Manager WordPress plugin before version 7.4.1 has a flaw where it does not properly restrict privileged actions. This allows unauthenticated users to manipulate user accounts whose IDs match the plugin's own post IDs. Attackers can change passwords, escalate to administrator, or delete those accounts.

Detection Guidance

Check if the Events Manager plugin version is below 7.4.1. Inspect user accounts for IDs matching plugin post IDs. Monitor for unauthorized admin changes or password modifications.

Impact Analysis

If exploited, an attacker could gain full administrative access to your WordPress site, delete critical user accounts, or change passwords of existing users. This could lead to complete site takeover or data loss.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties.

Mitigation Strategies

Update the Events Manager plugin to version 7.4.1 or later immediately. Review and restrict user accounts with IDs matching plugin post IDs. Disable guest booking features if not required.

Hi! I’m here to help you understand CVE-2026-18366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70