CVE-2026-18366: fallo crítico en Events Manager
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
Publicada el
70Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.
ssvc Actcvss 9.8epss 0.5%
de la publicación al arma4 días
Publicada en NVD12 ago
1ª PoC+4d
VulnCheck+19d
probabilidad de explotación
0.5%top 59% de las CVE
explotación observada
síVulnCheck
7 exploit(s) público(s)
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Events ManagerPoCs públicas encontradas — 7
githubgithub.com/Nxploited/CVE-2026-18366★ 2githubgithub.com/ghostpels/CVE-2026-18366★ 0githubgithub.com/katranSefa/CVE-2026-18366★ 0cve_referencewpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/no verificadovulncheckvulncheck.com/xdb/465324173ac3no verificadovulncheckvulncheck.com/xdb/2152b4e16e23no verificadovulncheckvulncheck.com/xdb/6d7abbe53de7no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Events Manager
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-35012—Events Manager < 5.9.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2020-35037—Events Manager < 5.9.8 - Cross-Site Scripting (XSS)EPSS 0.9%CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.5%CVE-2026-18050HIGHEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsEPSS 0.4%CVE-2026-18057HIGHEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionEPSS 0.4%CVE-2026-93662MEDIUMEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterEPSS 0.2%