CVE-2026-16304

The WP Event Manager WordPress plugin before version 3.4.2 is vulnerable to a content takeover due to insufficient validation of user-supplied post identifiers in one of its frontend forms. Any user with a Subscriber account or higher can exploit this to reassign the authorship of arbitrary posts...