WP Event Manager plugin lets attackers overwrite unpublished posts
Anyone can overwrite unpublished posts through a WordPress event plugin.
Summary
The WP Event Manager WordPress plugin does not check the ownership or type of a post ID in its front-end event submission flow. Unauthenticated attackers can read and overwrite unpublished posts and pages.
What to do
Update WP Event Manager to 3.4.2 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen