CVE-2026-18366

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2026-08-12

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/
• Nxploited/CVE-2026-183660★ · 2026-08-16
• ghostpels/CVE-2026-18366

References

• CVE Record
• NVD entry

Related

• CVE-2026-13001
• CVE-2026-13610
• CVE-2026-18357
• CVE-2026-18391
• CVE-2026-18356
• CVE-2026-18395