Unauthenticated Privilege Escalation in Events Manager Plugin

The Events Manager WordPress plugin (versions 7.1.0 through 7.4.0.x) contains a critical privilege escalation vulnerability (CVE-2026-18366) stemming from an improperly implemented map_meta_cap filter. The vulnerability allows unauthenticated attackers to manipulate user accounts, including changing passwords and escalating roles to administrator, by exploiting the way the plugin handles capability checks for event and location post types.

When the WordPress REST API processes requests for users (e.g., /wp-json/wp/v2/users/{id}), it invokes the map_meta_cap filter. In the vulnerable versions, if the ID of the object being queried coincides with the ID of an event or location post, the plugin prematurely clears the required capabilities list. This results in the system incorrectly granting unauthorized access to sensitive operations like edit_user, delete_user, and promote_user. Attackers can force ID collisions via the plugin's guest booking feature to target specific users, making this a high-impact risk for WordPress sites utilizing the plugin.

Attack Chain

1. Attacker identifies a WordPress site running Events Manager version 7.1.0 - 7.4.0.x with guest bookings enabled.
2. Attacker enumerates existing public event or location IDs to find target IDs or to prepare for a collision.
3. Attacker uses the wp_ajax_nopriv_booking_add endpoint to submit multiple guest bookings, causing the wp_users ID sequence to increment until it matches a targeted event or location post ID.
4. Once a collision is achieved (or if a naturally occurring collision exists), the attacker targets the specific user ID via the REST API endpoint /wp-json/wp/v2/users/{id}.
5. The plugin's map_meta_cap filter incorrectly validates the request because the user_id matches an event_id, clearing the required capability list.
6. Attacker sends a PUT request to the REST API to change the password of the account associated with the collided ID.
7. Attacker sends a secondary PUT request to promote the compromised account to the administrator role.
8. Attacker logs into the WordPress administrative dashboard to gain full control of the site.

Impact

Successful exploitation results in full administrative control over the affected WordPress installation. Given the CVSS 9.8 rating, this vulnerability poses a severe threat to site confidentiality, integrity, and availability. All sites using the vulnerable versions are susceptible to complete data exfiltration, defacement, or total site takeover by unauthenticated remote actors.

Recommendation

1. Immediately update the Events Manager plugin to version 7.4.1 or later.
2. Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious requests to /wp-json/wp/v2/users/ and /wp-admin/admin-ajax.php?action=booking_add originating from non-authenticated sources.
3. Review audit logs for unexpected account creation or role promotion events associated with the REST API.
4. Restrict access to administrative REST API endpoints to trusted IP addresses where possible.