Blog Events Manager takeover and four other critical plugin patches
Events Manager takeover and four other critical plugin patches
A capability-mapping bug in Events Manager lets an unauthenticated visitor take over any admin account whose user ID matches one of the plugin's records, and four other WordPress plugins shipped critical fixes for RCE and payment-bypass holes.
Events Manager is a schedule-and-tickets plugin, and the version before 7.4.1 shipped with a capability-mapping bug that discards WordPress’s own access-control decisions for a set of unrelated privileged actions. An unauthenticated visitor whose crafted request happens to reference a user ID that matches one of the plugin’s own records can change that account’s password, promote it to Administrator, or delete it outright. There is no login step in the chain. Patched in 7.4.1, and the current release on the directory is 7.4.2. CVE-2026-18366.
woocommerce-subscriptions before 9.1.0 unserializes user-controlled input on stores that have High-Performance Order Storage turned on, and a gadget chain in one of the plugin’s bundled dependencies is enough to turn that into remote code execution. NVD places the exploit in reach of an unauthenticated attacker. Patched in 9.1.0. CVE-2026-18391.
The wpmudev-updates plugin exposes a remote management interface that accepts signed instructions to install packages, and versions before 5.0.1 neither verify the integrity of what gets installed nor guard the request against replay. Anyone who can capture or replay one valid signed message can push arbitrary code onto the site and run it. Patched in 5.0.1. CVE-2026-16051.
The giftware plugin has an upload path that skips the file-type check entirely, letting an unauthenticated visitor drop a .php file straight into the site and execute it. Patched in 4.2.10. CVE-2026-15039.
wallet-for-woocommerce is the least severe of the batch and, in a way, the most quietly costly. Versions before 1.6.10 credit a customer’s wallet balance for the amount the customer said they were topping up, without checking what actually landed in the payment processor. A shopper can claim a hundred-dollar top-up after paying a dollar and spend the difference on real products. Patched in 1.6.10. CVE-2026-16538.
Two of the code-execution paths above — the deserialization gadget in woocommerce-subscriptions and the type-blind upload in giftware — leave the kind of footprint a scanner can find after the fact: an unfamiliar PHP file under wp-content/uploads, or a modified plugin file whose contents no longer match what the vendor shipped. Patching closes the door. Scanning is what tells you whether anything walked through it first.
For sites that want a scanner built for exactly this kind of plugin compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve