CVE-2026-16304 · Package
NO FIX YET · SEE WHAT TO DO
The WP Event Manager WordPress plugin before 3.4.2 fails to check who owns the post IDs submitted through one of its frontend forms. A logged-in Subscriber can reassign authorship of any post to themselves and force it to publish, exposing private or draft content.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running WP Event Manager before 3.4.2 that have its frontend form feature enabled and allow Subscriber accounts or higher to log in. Sites without that feature enabled, or running the patched version, are not exposed by this description.
Not affected if frontend-feature-disabled, no-subscriber-accounts, plugin-updated-to-3.4.2
Who cares wordpress, wp-event-manager
3.4.2 is affected.3.4.2The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.