WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post Read and Overwrite via 'event_id'
- ID
- WPSEC-2026-2206
- Plugin
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce (wp-event-manager)
- Affected
- all versions before 3.4.2
- Remediation
- Update to 3.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WP Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'event_id' parameter of the front-end event submission form in all versions up to, and including, 3.4.1, due to the event_manager_user_can_edit_event() function granting edit access to logged-out visitors for any supplied post ID without checking ownership or post type. This makes it possible for unauthenticated attackers to view and overwrite the title, content and metadata of arbitrary draft, pending or preview posts, including other users' events and posts of other types (which are converted to events), unless the site requires an account to submit and has registration disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2206/
- https://plugins.svn.wordpress.org/wp-event-manager/tags/3.4.2/
- https://wordpress.org/plugins/wp-event-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS