CVE-2026-18366: falha crítica em Events Manager
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
Publicada em
70Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actcvss 9.8epss 0.5%
da publicação à arma4 dias
Publicada no NVD12 de ago.
1ª PoC+4d
VulnCheck+19d
probabilidade de exploração
0.5%top 59% das CVEs
exploração observada
simVulnCheck
7 exploit(s) público(s)
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Events ManagerPoCs públicas encontradas — 7
githubgithub.com/Nxploited/CVE-2026-18366★ 2githubgithub.com/ghostpels/CVE-2026-18366★ 0githubgithub.com/katranSefa/CVE-2026-18366★ 0cve_referencewpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/não verificadovulncheckvulncheck.com/xdb/465324173ac3não verificadovulncheckvulncheck.com/xdb/2152b4e16e23não verificadovulncheckvulncheck.com/xdb/6d7abbe53de7não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Events Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2020-35012—Events Manager < 5.9.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2020-35037—Events Manager < 5.9.8 - Cross-Site Scripting (XSS)EPSS 0.9%CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.5%CVE-2026-18050HIGHEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsEPSS 0.4%CVE-2026-18057HIGHEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionEPSS 0.4%CVE-2026-93662MEDIUMEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterEPSS 0.2%