{"id":"CVE-2026-86442","kind":"vulnerability","aliases":["CVE-2026-86442"],"related":[],"title":"WP Event Manager WordPress plugin lets anyone overwrite unpublished posts","description":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","summary":"The WP Event Manager plugin for WordPress does not check who owns or what type a post identifier is in its front-end event submission flow. An unauthenticated attacker can read and overwrite unpublished posts and pages, and turn them into events.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-event-manager"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the WP Event Manager plugin in the WordPress admin under Plugins; versions below `3.4.2` are in the affected range.\n- Confirm whether the front-end event submission form is enabled on the site.","fix":"- WP Event Manager: `3.4.2` (fixed version per the advisory description)","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:05+00:00","updated_at":"2026-11-05T06:33:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:05Z","model":"claude-haiku-5-5","output":{"fix":"- WP Event Manager: `3.4.2` (fixed version per the advisory description)","reach":"internet","title":"WP Event Manager WordPress plugin lets anyone overwrite unpublished posts","impact":"medium","summary":"The WP Event Manager plugin for WordPress does not check who owns or what type a post identifier is in its front-end event submission flow. An unauthenticated attacker can read and overwrite unpublished posts and pages, and turn them into events.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-event-manager"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers overwrite and read unpublished posts and pages anonymously.","analyst_note":"","how_to_check":"- Check the installed version of the WP Event Manager plugin in the WordPress admin under Plugins; versions below `3.4.2` are in the affected range.\n- Confirm whether the front-end event submission form is enabled on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-updated","plugin-not-installed"],"who_is_affected":"Sites running the WP Event Manager plugin before 3.4.2 that accept front-end event submissions are exposed, since the flaw sits in that submission flow and needs no login. Sites without the plugin or with it updated to 3.4.2 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4224,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86442':13A,16A '3.4.2':73C 'allow':97C 'anyon':7A 'arbitrari':107C 'attack':52B,99C 'check':32B 'content':105C 'convert':114C 'cve':11A,14A 'end':46B,93C 'event':2A,21B,25B,47B,65B,68C,94C,117C 'flow':49B,96C 'front':45B,92C 'front-end':44B,91C 'identifi':40B,88C 'let':6A 'manag':3A,22B,26B,69C 'overwrit':8A,56B,103C 'own':34B 'ownership':78C 'packag':17B 'page':60B,111C 'plugin':5A,27B,71C 'post':10A,39B,58B,81C,87C,109C 'read':54B,101C 'submiss':48B,95C 'suppli':86C 'turn':62B 'type':37B,82C 'unauthent':51B,98C 'unpublish':9A,57B,108C 'user':85C 'verifi':76C 'wordpress':4A,18B,29B,70C 'wp':1A,20B,24B,67C 'wp-event-manag':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Event Manager plugin before 3.4.2 that accept front-end event submissions are exposed, since the flaw sits in that submission flow and needs no login. Sites without the plugin or with it updated to 3.4.2 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","wordpress","wpeventmanager"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86442","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}