CVE-2026-18366 is an improper privilege management vulnerability (CWE-269) in the Events Manager WordPress plugin versions before 7.4.1. The plugin fails to correctly scope capability mappings, which causes it to override WordPress's native access control decisions for privileged actions. As a result, unauthenticated attackers can manipulate user accounts—changing passwords, escalating privileges to Administrator, or deleting accounts—if the targeted user ID matches one of the plugin's post IDs. This vulnerability is specific to version 7.1 as explicitly stated, and no CVSS score or official patch information is currently available.

This vulnerability allows unauthenticated attackers to perform high-impact actions including password changes, privilege escalation to Administrator, and account deletion. Such actions compromise the integrity and security of the affected WordPress site by enabling unauthorized control over user accounts. The impact is severe due to the ability to escalate privileges without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to the plugin or disabling it may reduce risk. Avoid relying on the plugin in environments where unauthenticated privilege escalation would be critical.