{"id":"CVE-2026-16304","kind":"vulnerability","aliases":["CVE-2026-16304"],"related":[],"title":"WP Event Manager WordPress plugin lets subscribers take over posts","description":"The WP Event Manager  WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.","summary":"The WP Event Manager WordPress plugin before 3.4.2 fails to check who owns the post IDs submitted through one of its frontend forms. A logged-in Subscriber can reassign authorship of any post to themselves and force it to publish, exposing private or draft content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-event-manager"],"not_affected_if":["frontend-feature-disabled","no-subscriber-accounts","plugin-updated-to-3.4.2"],"how_to_check":"- Check the installed version of the WP Event Manager plugin in the WordPress admin under Plugins; a version below `3.4.2` is affected.\n- Confirm whether the relevant frontend feature of the plugin is enabled, since the sources say it must be enabled for the flaw to apply.","fix":"- WP Event Manager: `3.4.2`","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:12+00:00","updated_at":"2026-11-05T06:33:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T06:33:12Z","model":"claude-haiku-5-5","output":{"fix":"- WP Event Manager: `3.4.2`","reach":"internet","title":"WP Event Manager WordPress plugin lets subscribers take over posts","impact":"medium","summary":"The WP Event Manager WordPress plugin before 3.4.2 fails to check who owns the post IDs submitted through one of its frontend forms. A logged-in Subscriber can reassign authorship of any post to themselves and force it to publish, exposing private or draft content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-event-manager"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker takes over site posts and publishes private or draft content","analyst_note":"","how_to_check":"- Check the installed version of the WP Event Manager plugin in the WordPress admin under Plugins; a version below `3.4.2` is affected.\n- Confirm whether the relevant frontend feature of the plugin is enabled, since the sources say it must be enabled for the flaw to apply.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-updated-to-3.4.2","frontend-feature-disabled","no-subscriber-accounts"],"who_is_affected":"Sites running WP Event Manager before 3.4.2 that have its frontend form feature enabled and allow Subscriber accounts or higher to log in. Sites without that feature enabled, or running the patched version, are not exposed by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4265,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-16304':13A,16A '-2026':12A,15A '3.4.2':30B,76C 'account':105C 'allow':99C 'arbitrari':113C 'authorship':53B,111C 'check':33B 'content':68B,127C,139C 'cve':11A,14A 'disclosur':133C 'draft':67B,138C 'enabl':148C 'event':2A,21B,25B,71C 'expos':64B 'fail':31B 'featur':145C 'forc':60B,119C 'form':45B,98C 'frontend':44B,97C,144C 'id':38B 'identifi':91C 'let':6A 'log':48B 'logged-in':47B 'manag':3A,22B,26B,72C 'one':41B,94C 'otherwis':135C 'own':35B 'ownership':81C 'packag':17B 'plugin':5A,28B,74C 'post':10A,37B,56B,90C,114C 'privat':65B,136C 'process':92C 'proper':79C 'public':132C 'publish':63B,123C 'reassign':52B,109C 'relev':143C 'requir':141C 'result':125C 'submit':39B 'subscrib':7A,50B,104C 'suppli':89C 'take':8A 'takeov':128C 'type':84C 'user':88C,101C 'user-suppli':87C 'valid':80C 'wordpress':4A,18B,27B,73C 'wp':1A,20B,24B,70C 'wp-event-manag':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Event Manager before 3.4.2 that have its frontend form feature enabled and allow Subscriber accounts or higher to log in. Sites without that feature enabled, or running the patched version, are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wpeventmanager"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16304","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}