CVE-2025-6366

Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation

View on CVE.org
Published Aug 26, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.

Analysis

AI-generated

Technical impact

The Event List plugin for WordPress is vulnerable due to a lack of capability validation in the el_update_profile() function. Authenticated users with Subscriber-level access or higher can modify their role to Administrator, giving them full administrative control over the site, including installing plugins, altering settings, and accessing sensitive data.

Affected Systems

The flaw affects every WordPress site that has Event List version 2.0.4 or earlier installed by ovatheme.com. Any account that can log in as a Subscriber or higher is a potential target for privilege escalation.

Risk and Exploitability

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score of less than 1% suggests exploitation is unlikely in the near term, and the flaw is not yet listed in CISA KEV. Because the attack requires only a normal profile update by an authenticated user, the exploitation path is straightforward for those who can log in.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Event List to a version newer than 2.0.4 or apply the vendor’s official patch if available.
  • Restrict usage of el_update_profile() by disabling or limiting profile update features for Subscriber and lower roles until the fix is deployed.
  • If an immediate upgrade is not possible, review all Subscriber accounts and temporarily reduce their capabilities to a non-administrative role or remove them until the patch is applied, ensuring no user can elevate privileges via this path.

Generated by OpenCVE AI on April 22, 2026 at 04:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-28729 The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
History
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
Title Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-269

    Improper Privilege Management

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:54 PM
Reserved
Jun 19, 2025, 1:43 PM

View source JSON

Updated
Aug 26, 2025, 3:07 PM

JSON

Status
Deferred
Published
Aug 26, 2025, 3:15 PM
Modified
Jun 17, 2026, 10:01 AM

View source JSON

No data.

Updated
Apr 22, 2026, 4:15 AM

JSON