CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - 未认证权限提升至管理员 🔗 保持更新 获取最新的零日漏洞、漏洞利用与安全研究 📋 漏洞概述 🔍 技术描述 根本原因分析 漏洞存在于 classes/em-archetypes.php 中的 EM\Archetypes::mapmetacap。该插件错误地限定了能力映射的范围： 1. 将任意 对象 ID 视为文章 ID 2. 如果文章是 event 或 location 自定义文章类型（CPT），则会清空 $caps = 3. 从不重新为 edituser、deleteuser 或 promoteuser 填充能力...

CVE-2026-18366

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

CVE-2026-18366 Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

PT-2026-71024

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...