What’s Vulnerable › Vulnerabilities
CVE-2026-18366: Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-08-26
- Weakness: CWE-269
Description
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
Affected products
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!: from 7.1 before 7.4.1 — fixed in 7.4.1
How to fix
Upgrade to a fixed version: netweblogic Events Manager – Calendar, Bookings, Tickets, and more! 7.4.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18366 or the next vulnerability affects your stack