---
id: CVE-2026-86442
title: >-
  WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite
  via IDOR
summary: >-
  The WP Event Manager  WordPress plugin before 3.4.2 does not verify the
  ownership or the post type of a user supplied post identifier in its front-end
  event submission flow, allowing unauthenticated attackers to read and
  overwrite the co…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: WP Event Manager
affected:
  - wp_event_manager >= 3.4.0 < 3.4.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:51:49.890791Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:04:50.445Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86442'
references:
  - url: 'https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/'
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.09034
ingestedAt: '2026-11-05T21:36:00.779Z'
---

## Overview

The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

## Affected

- `wp_event_manager >= 3.4.0 < 3.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.