CVE-2026-16304
UnknownSummary
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or type of user-supplied post identifiers processed by one of its frontend forms. This allows any user with a Subscriber account or above to reassign authorship of arbitrary posts to themselves and force them to be published, resulting in content takeover and public disclosure of private or draft content; the relevant frontend feature must be enabled.
Risk Assessment
Content takeover and public disclosure of private or draft materials are possible, violating confidentiality and integrity of the site.
Recommendation
Update the WP Event Manager plugin to version 3.4.2 or later.
Other vulnerabilities in WP Event Manager
See all- CVE-2026-86442Unknown
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or post type of a user-supplied post identifier in its front-end event submission flow. This allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages and convert them into events.
- CVE-2026-62041Medium
The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.
Original NVD description (English source)
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS