Threats tagged 'ghsa-3jgh-hp3g-cxqq'

A vulnerability in the WP Event Manager WordPress plugin before version 3.4.2 allows unauthenticated attackers to read and overwrite arbitrary unpublished posts and pages, and convert them into events. This occurs because the plugin does not verify ownership or post type of user-supplied post identifiers in its front-end event submission flow.