Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-12 | 1 | Disclosure1 |
| 2026-08-16 | 1 | Exploit1 |
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator PoC: https://github.com/Nxploited/CVE-2026-18366 #exploit #wordpress
Post summary
A PoC for CVE‑2026‑18366 that enables unauthenticated privilege escalation in Events Manager <7.4.1 has been shared, with no evidence of active exploitation or a patch.
CVE-2026-18366 The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for u… https://www.cve.org/CVERecord?id=CVE-2026-18366
Post summary
The CVE highlights a WordPress plugin’s mismanagement of capability mapping leading to potential privilege escalation; no PoC, exploit, or patch notice is provided.