Executive brief
The Events Manager WordPress plugin before 7.4.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to take over administrator accounts. By exploiting improper access control in the plugin's capability mapping, an attacker can reset passwords, escalate roles to administrator, or delete any account that has a user ID matching an Events Manager post ID. This gives attackers full control of the WordPress site without needing credentials.
Technical details
The vulnerability is a privilege escalation (CWE-269) stemming from improper capability scoping in the Events Manager plugin. The plugin incorrectly maps WordPress capabilities, discarding the core's access control decisions and allowing unauthenticated REST API calls to modify user accounts via /wp-json/wp/v2/users/ endpoints. The attack requires a collision between a user ID and an Events Manager post ID; attackers can force this collision by creating guest bookings (which auto-create user accounts and increment the ID counter). No authentication, nonce, or cookie is required. Once a collision is achieved, an attacker can modify password, email, and roles fields to escalate any account to administrator. The vulnerability affects Events Manager versions 7.1 through 7.4.0.1 and is fixed in 7.4.1.
Affected products
- Worx Events Manager 7.1 through 7.4.0.1
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in version 7.4.1