CVE-2026-18366
UnknownSummary
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the plugin's own posts.
Risk Assessment
An unauthenticated attacker can take over user accounts, including administrators, potentially leading to full site compromise.
Recommendation
Update the Events Manager plugin to version 7.4.1 or later. Immediately check for unauthorized account changes.
Original NVD description (English source)
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.