CVE-2026-86442: WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR

Published Nov 5, 2026

Updated

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using WP Event Manager versions 3.4.0 or 3.4.1 are affected. The vulnerable path is the plugin’s front-end event submission flow.

Does an attacker need an account or special permissions?

No. The issue can be exploited by an unauthenticated attacker through the front-end submission flow.

What content can be targeted?

An attacker can read and overwrite arbitrary unpublished posts and pages when they can supply a post identifier. The targeted content can also be converted into an event.

What should be prioritized for remediation?

Update WP Event Manager to version 3.4.2 or later, since versions before 3.4.2 are described as vulnerable. Review unpublished posts and pages for unexpected content changes or conversion into events.

CVE-2026-86442: WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

Does an attacker need an account or special permissions?

What content can be targeted?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

Does an attacker need an account or special permissions?

What content can be targeted?

What should be prioritized for remediation?