Is CVE-2026-16304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16304 being exploited in the wild.

How severe is CVE-2026-16304?

Informational severity, published 5 November 2026.

Which products and versions are affected?

WordPress.org WP Event Manager before 3.4.2.

Is there a fix for CVE-2026-16304?

Yes: fixed in 3.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16304 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16304?

Check whether you run WordPress.org WP Event Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16304: WP Event Manager arbitrary post takeover via post identifier validation

CVE-2026-16304 · Severity: info · Published 2026-11-05

WP Event Manager is a WordPress plugin that manages event creation and organization. A flaw in the plugin allows any user with a basic subscriber account to take over posts created by other users, reassign them to themselves, and force them to be published. This exposes private and draft content that should remain hidden, and enables attackers to impersonate other authors or publish unauthorized content.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-16304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16304 being exploited in the wild.
How severe is CVE-2026-16304?: Informational severity, published 5 November 2026.
Which products and versions are affected?: WordPress.org WP Event Manager before 3.4.2.
Is there a fix for CVE-2026-16304?: Yes: fixed in 3.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16304 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16304?: Check whether you run WordPress.org WP Event Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.2

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability in the plugin's frontend form processing fails to validate post ownership or validate the type of user-supplied post identifiers. Any authenticated user with Subscriber privileges or higher can reassign arbitrary posts' authorship and modify their publication status. The vulnerability requires the affected frontend feature to be enabled and an attacker to be authenticated as a Subscriber or above.

Affected products

WordPress.org WP Event Manager before 3.4.2

Timeline

2026-11-02: disclosed
2026-11-05: advisory

References

https://wpscan.com/vulnerability/53d611e2-4ca6-4117-bc33-040488c19a72/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.