Privilege Escalation Vulnerability in Event Calendar Plugin for WordPress

CVE-2026-75983

What is CVE-2026-75983?

The Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress contains a vulnerability that allows authenticated users with a user ID of 1 to bypass capability checks. The issue arises from improper handling in the PermissionManager::manage_permissions() function, which always returns true for capability checks. This flaw permits even subscribers, with user ID 1, to gain elevated privileges, enabling them to access and modify sensitive settings and perform actions reserved for administrators. While default installations maintain user ID 1 as an admin, this vulnerability is critical when the account is demoted for security purposes. Attackers can exploit this to gain full control over the site, including the ability to run remote code through the plugin and theme editors.

References