Events Manager capability mapping can grant Administrator control
Events Manager from 7.1 before 7.4.1 resets WordPress's already-derived capability requirements inside EM_Archetypes::map_meta_cap() whenever an object ID resolves to an Events Manager post, even when the requested capability is unrelated. An empty required-capability list is treated as allowed. If a user ID collides with an Events Manager post ID, an unauthenticated attacker can change that user's password, promote the account to Administrator or delete it. The exact HTTP endpoint and request sequence are not disclosed; the affected operations are WordPress user edit, promotion and deletion capability checks.
- Component
- Events Manager
- Plugin slug
events-manager- Affected
- 7.1 to < 7.4.1
- Safe version
7.4.1- Published
- Aug 12, 2026
This CVE was published Aug 12, 2026 and is one of 46 known issues for this plugin.
Update, patch or deactivate.
Update to 7.4.1 or later immediately. Review user password, role and deletion activity, restore affected accounts, invalidate sessions, and rotate privileged credentials.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H