---
id: "CVE-2026-16304"
kind: "vulnerability"
aliases: ["CVE-2026-16304"]
title: "WP Event Manager WordPress plugin lets subscribers take over posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-event-manager"]
not_affected_if: ["frontend-feature-disabled", "no-subscriber-accounts", "plugin-updated-to-3.4.2"]
published_at: "2026-11-05T06:17:08+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16304", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# WP Event Manager WordPress plugin lets subscribers take over posts

The WP Event Manager WordPress plugin before 3.4.2 fails to check who owns the post IDs submitted through one of its frontend forms. A logged-in Subscriber can reassign authorship of any post to themselves and force it to publish, exposing private or draft content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Event Manager plugin in the WordPress admin under Plugins; a version below `3.4.2` is affected.
- Confirm whether the relevant frontend feature of the plugin is enabled, since the sources say it must be enabled for the flaw to apply.

## Fix

- WP Event Manager: `3.4.2`

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16304

## From the sources

The WP Event Manager  WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_