{
 "id": "WPSEC-2026-2206",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2206/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2206/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2206/index.md",
 "title": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary Post Read and Overwrite via 'event_id'",
 "description": "The WP Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'event_id' parameter of the front-end event submission form in all versions up to, and including, 3.4.1, due to the event_manager_user_can_edit_event() function granting edit access to logged-out visitors for any supplied post ID without checking ownership or post type. This makes it possible for unauthenticated attackers to view and overwrite the title, content and metadata of arbitrary draft, pending or preview posts, including other users' events and posts of other types (which are converted to events), unless the site requires an account to submit and has registration disabled.",
 "plugin": {
  "slug": "wp-event-manager",
  "name": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce",
  "full_name": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-manager"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.2",
 "remediation": "Update to 3.4.2 or later.",
 "fix_released": "2026-10-30T09:20:40+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:54.585342+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2206/",
  "https://plugins.svn.wordpress.org/wp-event-manager/tags/3.4.2/",
  "https://wordpress.org/plugins/wp-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}