Description

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-12T06:20:07.460Z",
  "pubdate": "2026-08-12T06:20:07.460Z",
  "executiveSummary": "The Events Manager WordPress plugin before 7.4.1 suffers from a critical security flaw stemming from improperly scoped capability mapping. This vulnerability allows unauthenticated remote attackers to execute high-privilege administrative actions, including changing account passwords, escalating arbitrary users to Administrator status, and deleting user accounts.\nThe root cause lies in the plugin discarding access control decisions previously enforced by WordPress core for unrelated privileged actions. Exploitation occurs when a targeted user's numeric ID coincidentally matches the ID of a post managed by the Events Manager plugin. Because no authentication or valid session tokens are required, threat actors can leverage this discrepancy to bypass standard authorization boundaries entirely.\nThe risk implications are severe, as successful exploitation directly leads to full system compromise and loss of data integrity. Affected systems are instances of the Events Manager WordPress plugin utilizing versions prior to 7.4.1. Remediation requires immediate updating to version 7.4.1 or later to restore proper capability checks and access control validation within the plugin's codebase.",
  "technicalDetails": "The vulnerability is localized within the Events Manager WordPress plugin in versions prior to 7.4.1. The core architectural flaw involves improper scoping during the capability mapping process, where the plugin intercepts and evaluates permissions for actions in a manner that overrides or discards standard access control decisions already determined by WordPress core.\nIn typical WordPress execution flows, when a user attempts to perform a sensitive operation, the application checks user capabilities against defined roles. However, the affected versions of the Events Manager plugin fail to maintain correct context when mapping capabilities for its own internal post types and related operations. Specifically, the capability checking logic contains a flaw where a request referencing a specific numeric ID is evaluated against the ID space of posts generated or managed by the plugin rather than properly enforcing user-level authentication and authorization.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts an HTTP request targeting administrative functionalities, such as password modification, user role escalation, or account deletion. Due to the mismanaged capability mapping, the plugin processes the request by evaluating the target user ID supplied in the payload against the ID of an Events Manager post. If the targeted user ID numerically matches the ID of an existing Events Manager post, the plugin erroneously assumes the context is valid, bypasses the standard authentication and authorization checks enforced by WordPress, and executes the privileged action.\nAs a result of this payload behavior, an unauthenticated remote attacker can force the application to alter administrative credentials, grant Administrator privileges to an attacker-controlled account, or purge arbitrary user records from the database. The vulnerability requires network exposure via the web application interface, requires zero authentication, and demands no prior privileges, making it exceptionally critical for automated exploitation scripts."
}