CVE-2026-16304
High
Description
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
SeverityHigh
CVSS8.1
Exploit probability3. percentile0.1%
ProductWP Event Manager
PublishedNov 5, 2026
First seenNov 5, 2026
How to fix
Update
- WP Event Manager3.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Event Manager | v < 3.4.2 | 3.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.