CVE-2026-86442

Name of the Vulnerable Software and Affected Versions WP Event Manager versions prior to 3.4.2

Description The front-end event submission flow fails to verify the ownership or post type of a user-supplied post identifier. This Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and subsequently convert them into events.

Recommendations Update to version 3.4.2 or later.