{
 "id": "WPSEC-2026-2207",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2207/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2207/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2207/index.md",
 "title": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Organizer and Venue Takeover via 'event_organizer_ids' and 'event_venue_ids'",
 "description": "The WP Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'event_organizer_ids' and 'event_venue_ids' parameters of the event submission form in all versions up to, and including, 3.4.1, due to missing validation of the submitted organizer and venue IDs. The plugin assigned each referenced post to the submitting user and set it to published without checking its post type or owner. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over other users' organizers and venues, and to reassign and publish arbitrary posts such as other users' drafts.",
 "plugin": {
  "slug": "wp-event-manager",
  "name": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce",
  "full_name": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-manager"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.2",
 "remediation": "Update to 3.4.2 or later.",
 "fix_released": "2026-10-30T09:20:40+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:54.585342+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2207/",
  "https://plugins.svn.wordpress.org/wp-event-manager/tags/3.4.2/",
  "https://wordpress.org/plugins/wp-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}