Threats tagged 'ghsa-x9pc-jr5g-gf8w'

The WP Event Manager WordPress plugin versions prior to 3.4.2 contain a vulnerability where the plugin does not properly validate ownership or the type of user-supplied post identifiers in a frontend form. This flaw allows users with Subscriber accounts or higher to reassign authorship of arbitrary posts to themselves and force those posts to be published, potentially exposing private or draft content publicly. The vulnerability requires the relevant frontend feature to be enabled.