EUVD-2026-57099
GHSA-gpp5-qcrv-vm9j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network exploitation with a public exploit yields PR:N/AV:N; total account takeover gives C:H/I:H/A:H; AC kept Low despite the ID-collision precondition since low-numbered IDs are commonly attackable.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
AnalysisAI
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress account's numeric user ID exactly match the ID of one of the Events Manager plugin's own event posts - that ID collision is the specific, concrete precondition, and it is what limits exploitation to a subset of accounts on any given site rather than all accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with total confidentiality/integrity/availability impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running a vulnerable Events Manager version and determines that the site-owner administrator account (user ID 1) collides with an early Events Manager event-post ID. Using the publicly available exploit technique, the attacker sends a crafted request that the plugin mis-authorizes, changing that administrator's password or elevating an attacker-controlled account to Administrator. … |
| Remediation | Vendor-released patch: upgrade the Events Manager plugin to version 7.4.1 or later, which properly scopes the capability mapping; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately upgrade Events Manager plugin to version 7.4.1 or later on all WordPress instances and verify successful deployment via the admin dashboard. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Events Manager
View allThe Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injecti
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authe
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malici
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Go
PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.
Missing Authorization vulnerability in Pixelite Events Manager.4.6.4. Rated high severity (CVSS 8.8), this vulnerability
The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plu
The Events Manager - Calendar, Bookings, Tickets, and more!. Rated high severity (CVSS 7.5), this vulnerability is remot
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Ma
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today