The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
Metrics
Affected Vendors & Products
References
History
Wed, 27 Aug 2025 11:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Wordpress
Wordpress wordpress |
|
Vendors & Products |
Wordpress
Wordpress wordpress |
Tue, 26 Aug 2025 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Tue, 26 Aug 2025 14:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator. | |
Title | Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation | |
Weaknesses | CWE-269 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2025-08-26T15:07:45.824Z
Reserved: 2025-06-19T13:43:14.885Z
Link: CVE-2025-6366

Updated: 2025-08-26T15:07:41.278Z

Status : Awaiting Analysis
Published: 2025-08-26T15:15:48.710
Modified: 2025-08-29T16:22:31.970
Link: CVE-2025-6366

No data.

Updated: 2025-08-27T11:21:41Z