CVE-2026-86442 Details
Description
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
A vulnerability in the WP Event Manager WordPress plugin, affecting versions prior to 3.4.2, allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages. The vulnerability arises because the plugin's front-end event submission process does not verify the ownership or post type of user-supplied post identifiers. Exploitation of this flaw enables attackers to convert the targeted posts and pages into events.
Users are advised to update the WP Event Manager WordPress plugin to version 3.4.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| WP Event Manager | >= 3.4.0, <= 3.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |