CVE-2026-86442
UnknownSummary
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or post type of a user-supplied post identifier in its front-end event submission flow. This allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages and convert them into events.
Risk Assessment
Attackers can disclose private or draft content and modify it without authentication, leading to data leakage and integrity compromise of the site.
Recommendation
Update the WP Event Manager plugin to version 3.4.2 or later.
Other vulnerabilities in WP Event Manager
See all- CVE-2026-16304Unknown
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or type of user-supplied post identifiers processed by one of its frontend forms. This allows any user with a Subscriber account or above to reassign authorship of arbitrary posts to themselves and force them to be published, resulting in content takeover and public disclosure of private or draft content; the relevant frontend feature must be enabled.
- CVE-2026-62041Medium
The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.
Original NVD description (English source)
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS