WP Event Manager plugin lets users take over others' posts
Anyone with a basic account can take over and publish others' posts on this event plugin.
Summary
A frontend form in the WP Event Manager WordPress plugin does not check who owns the posts it changes. Any account with Subscriber access or higher can take over arbitrary posts and publish private or draft content on sites where the feature is enabled.
Affected when
- the relevant frontend feature enabled
What to do
Update to version 3.4.2.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen