Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-18366: Events Manager WordPress plugin - Unauthenticated Admin Access
CVE-2026-18366 · published 2 months ago
Summary
An older version of the Events Manager WordPress plugin allows anyone to become an administrator or change/delete other users' accounts without logging in. This is a security concern because it could lead to unauthorized changes to your website. Update the plugin to version 7.4.1 or later to fix this issue.
What to do
- Update unknown events manager to version 7.4.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | events manager | < 7.4.1 |
Original advisory text
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published12 Aug 2026
Updated4 Nov 2026
First seen12 Aug 2026
Track software like this
Free during beta