{"affected":[],"aliases":["CVE-2026-86442"],"database_specific":{"cwe_ids":[],"github_reviewed":false,"github_reviewed_at":null,"nvd_published_at":"2026-11-05T06:17:09Z","severity":null},"details":"The WP Event Manager  WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.","id":"GHSA-3jgh-hp3g-cxqq","modified":"2026-11-05T06:34:38Z","published":"2026-11-05T06:34:38Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86442"},{"type":"WEB","url":"https://wpscan.com/vulnerability/bcc4df7e-86a0-4614-9b3a-8629f6335b8a"}],"schema_version":"1.4.0","severity":[]}