CVE-2026-86442

HighCVSS 8.2/10Last modified Nov 6, 2026

Description

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	WP Event Manager	>= 3.4.0, < 3.4.2

References

https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/

Timeline

Published: Nov 5, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864436.9Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local CVE-2026-864447.1The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, a CVE-2026-864455.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowin CVE-2026-864463.7The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing una CVE-2026-864475.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing una CVE-2026-864483.7The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously gen CVE-2026-864495.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in o CVE-2026-864507.5Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal a CVE-2026-864514.3Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data(CVE-2026-864527.5Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bound CVE-2026-86469.1IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP CVE-2026-864609.8Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Sync