WP Event Manager vulnerabilities
We track 3 vulnerabilities in WP Event Manager products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest WP Event Manager vulnerabilities
- 8.2 High severity
WP Event Manager: Authorization Bypass Through User-Controlled Key
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpub
- 8.1 High severity
WP Event Manager: Authorization Bypass Through User-Controlled Key
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of
- 8.1 High severity
WP Event Manager: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <=