by Kastro
Paper/Archive/CVE-2026-18366

CVE-2026-18366

Unknown Events Manager — Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

Affected

ProductAffectedFixed inSource
Events Manager7.1 – < 7.4.17.4.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd