---
id: CVE-2026-16304
title: >-
  WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via
  event_organizer_ids
summary: >-
  The WP Event Manager  WordPress plugin before 3.4.2 does not properly validate
  ownership or the type of the user-supplied post identifiers processed by one
  of its frontend forms, allowing any user with a Subscriber account or above to
  re…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: WP Event Manager
affected:
  - wp_event_manager < 3.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:52:53.377148Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:06:18.263Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16304'
references:
  - url: 'https://wpscan.com/vulnerability/53d611e2-4ca6-4117-bc33-040488c19a72/'
tags:
  - cve.org
epss: 0.00204
epssPercentile: 0.10452
ingestedAt: '2026-11-05T21:36:00.774Z'
---

## Overview

The WP Event Manager  WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.

## Affected

- `wp_event_manager < 3.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.