WP Event Manager vulnerabilities

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or post type of a user-supplied post identifier in its front-end event submission flow. This allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages and convert them into events.

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or type of user-supplied post identifiers processed by one of its frontend forms. This allows any user with a Subscriber account or above to reassign authorship of arbitrary posts to themselves and force them to be published, resulting in content takeover and public disclosure of private or draft content; the relevant frontend feature must be enabled.

The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.