{"cve":"CVE-2026-86442","enrichment":{"created":"2026-11-05T08:00:17.765814+00:00","updated":"2026-11-05T08:00:17.765820+00:00","vendors":[],"weaknesses":["CWE-639"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:24.685000+00:00","description":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/86xxx/CVE-2026-86442.json","references":["https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/"],"title":"WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR","updated":"2026-11-05T06:00:24.685000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:09.057000+00:00","description":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-86442.json","references":["https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/"],"title":null,"updated":"2026-11-05T06:17:09.057000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","old":null},"type":"description"},{"details":{"new":"WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/"],"removed":[]},"type":"references"}],"id":"214d27b4-8605-44ef-827a-329861231dd1"},{"created":"2026-11-05T08:15:00+00:00","data":[{"details":{"added":["CWE-639"],"removed":[]},"type":"weaknesses"}],"id":"8059273d-34ac-4e1b-8b3e-e21988b951e7"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:24.685000+00:00","provider":"mitre"},"description":{"data":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a/"],"providers":["mitre","nvd"]},"title":{"data":"WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR","provider":"mitre"},"updated":{"data":"2026-11-05T08:00:17.765820+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-639"],"providers":["enrichment"]}}}