Privilege Escalation Vulnerability in Event List Plugin for WordPress

CVE-2025-6366

What is CVE-2025-6366?

The Event List plugin for WordPress has a vulnerability that enables authenticated attackers, including those with Subscriber-level access, to escalate their privileges. This is possible because the plugin does not adequately verify user capabilities before modifying a user's profile through the el_update_profile() function. As a result, attackers can gain administrator-level permissions, which poses a significant security risk to affected WordPress sites.

References