A critical privilege escalation vulnerability in the Events Manager plugin allows unauthenticated users to gain administrative access or delete accounts.

The plugin incorrectly handles access control by ignoring established WordPress capability checks for specific actions. This flaw allows an unauthenticated attacker to escalate privileges or modify accounts if the target user ID coincides with an internal post ID used by the plugin.

This vulnerability allows for the total compromise of administrative accounts, leading to full site takeover and potential data theft. The CVSS score of 9.8 underscores the extreme risk of unauthorized privilege escalation, which can be leveraged to bypass all existing security controls within the WordPress dashboard.

Immediate Action: Update the Events Manager plugin to version 7.4.1 or later immediately.

Proactive Monitoring: Audit user account activity for unauthorized changes, new administrative account creation, or unexpected account deletions.

Compensating Controls: Use a Web Application Firewall (WAF) to filter suspicious traffic and block requests targeting administrative functions that should not be accessible to unauthenticated users.

Public Exploit Available: Unknown

Organizations must prioritize the update to version 7.4.1 to close this critical security gap. Given the existence of a proof-of-concept, the risk of exploitation is elevated, and failure to patch could result in a complete loss of administrative control over the affected web platform.