CVE-2026-16304
WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
| Vendor | unknown |
| Product | wp event manager |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp event manager
Be the first to know when new unknown vulnerabilities affecting unknown wp event manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Event Manager
0 < 3.4.2
References
Credits
Morato Antoine WPScan