CVE-2026-16304
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the…
- Risk score
- 49/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be publ…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.4.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
Last activity 5 Nov 2026. Patch Forecast updates every hour.