Read the docs
TI-2026-85348 Aliases CVE-2026-16304GHSA-x9pc-jr5g-gf8w

Post takeover by subscribers in WP Event Manager plugin

Priority LOW 37CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

The WP Event Manager WordPress plugin before 3.4.2 does not validate ownership or type of user-supplied post identifiers in one of its frontend forms, an authorization bypass through a user-controlled key (CWE-639). Any user with a Subscriber account or above can reassign authorship of arbitrary posts to themselves and force them to be published. This leads to content takeover and public disclosure of private or draft content, but only when the relevant frontend feature is enabled. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WP Event Manager (Unknown): 3.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Event Managerbefore 3.4.23.4.2Patch availableCNA
  • WP Event Manager VendorUnknown Affected before 3.4.2 Fixed in 3.4.2 Patch available CNA

Remediation

The WP Event Manager plugin is fixed in version 3.4.2, so sites running earlier versions must update to 3.4.2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA WP Event Manager (Unknown) Fixed in 3.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP Event Manager 3.4.2

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-85354 Unauthenticated overwrite of unpublished posts in WP Event ManagerPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-16304
  2. 2026-11-05 Alias added: GHSA-x9pc-jr5g-gf8w
  3. 2026-11-06 CVSS score added · CISA ADP
  4. 2026-11-06 Weakness changed · CISA ADP
  5. 2026-11-06 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences