CVE-2026-16304: WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids

Q: Who is exposed to exploitation?

Sites running WP Event Manager versions before 3.4.2 are exposed if the relevant frontend feature is enabled. An attacker must have a WordPress account with at least the Subscriber role.

Q: What can an attacker do after exploiting this issue?

They can reassign arbitrary posts to themselves and force those posts to be published. This can expose content that was previously private or still in draft state.

Q: Does exploitation require administrative access or a special post type?

No administrative access is indicated; a Subscriber-level account is sufficient. The affected processing does not properly validate either ownership or the type of user-supplied post identifiers, so arbitrary posts may be targeted.

Q: What is the immediate mitigation if an update cannot be applied?

Disable the relevant WP Event Manager frontend feature until the plugin can be updated to version 3.4.2 or later.

Published Nov 5, 2026

Updated

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Event Manager to a version that resolves this vulnerability.
Fixed in 3.4.2

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to exploitation?

Sites running WP Event Manager versions before 3.4.2 are exposed if the relevant frontend feature is enabled. An attacker must have a WordPress account with at least the Subscriber role.

What can an attacker do after exploiting this issue?

They can reassign arbitrary posts to themselves and force those posts to be published. This can expose content that was previously private or still in draft state.

Does exploitation require administrative access or a special post type?

No administrative access is indicated; a Subscriber-level account is sufficient. The affected processing does not properly validate either ownership or the type of user-supplied post identifiers, so arbitrary posts may be targeted.

What is the immediate mitigation if an update cannot be applied?

Disable the relevant WP Event Manager frontend feature until the plugin can be updated to version 3.4.2 or later.

CVE-2026-16304: WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do after exploiting this issue?

Does exploitation require administrative access or a special post type?

What is the immediate mitigation if an update cannot be applied?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do after exploiting this issue?

Does exploitation require administrative access or a special post type?

What is the immediate mitigation if an update cannot be applied?