CVE-2026-86442
Received Received - Intake

WP Event Manager Post Content Exposure and Modification

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: WPScan

Description
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-86442
EUVD
EUVD-2026-117339

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WP Event Manager 3.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the WP Event Manager WordPress plugin versions 3.4.0 to 3.4.1. It allows unauthenticated attackers to read or overwrite the content of any unpublished posts or pages by manipulating a user-supplied post identifier. The plugin fails to verify ownership or post type, enabling attackers to convert these posts into events.

Detection Guidance

To detect this vulnerability, check if your WP Event Manager plugin version is between 3.4.0 and 3.4.1. You can use commands like 'wp plugin list' in WordPress CLI or inspect the plugin version in the WordPress admin panel under Plugins.

Impact Analysis

Unauthenticated attackers could access, modify, or delete unpublished content on your WordPress site. They could also repurpose your content by converting posts or pages into events without permission. This could lead to data loss, unauthorized changes, or misuse of your site's content.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if exposed or altered. Compliance could be impacted due to potential breaches of data protection and access control policies.

Mitigation Strategies

Immediately update the WP Event Manager plugin to version 3.4.2 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...