Events Manager CVE-2026-18366

Exploitation requires that the target WordPress account's numeric user ID exactly match the ID of one of the Events Manager plugin's own event posts - that ID collision is the specific, concrete precondition, and it is what limits exploitation to a subset of accounts on any given site rather than all accounts. No authentication and no user interaction are required (PR:N/UI:N), and the vulnerability is reachable over the network against affected versions 7.1 through 7.4.0. Limiting factors: the plugin must be installed and at a vulnerable version, and a usable ID collision must exist (low-numbered/high-value accounts like the primary administrator are the most likely and most impactful collisions).

The signals are largely aligned toward high priority: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with total confidentiality/integrity/availability impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total. A public exploit exists and EPSS sits at an elevated 15%, well above the long-tail baseline, indicating meaningful real-world exploitation interest. The key tempering factor - one that raw CVSS does not capture - is the exploitation precondition: only accounts whose user ID happens to equal one of the plugin's own post IDs can be targeted, which narrows the set of directly-attackable accounts on any given site (though low-numbered IDs such as the ID 1 site owner are a plausible high-value collision). Because the exploit is automatable and the plugin is popular, defenders should not discount it: any mid-sized operator running a vulnerable version should treat patching as urgent rather than routine. Note it is NOT in CISA KEV, so this is POC-driven risk (publicly available exploit code exists) rather than confirmed active exploitation - do not conflate the two.

An unauthenticated attacker identifies a WordPress site running a vulnerable Events Manager version and determines that the site-owner administrator account (user ID 1) collides with an early Events Manager event-post ID. Using the publicly available exploit technique, the attacker sends a crafted request that the plugin mis-authorizes, changing that administrator's password or elevating an attacker-controlled account to Administrator. Given AV:N/AC:L and automatable exploitation, this can be scripted against many sites at scale.