CVE-2026-88799: high-severity vulnerability in MDJM Event Management
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CVEs — MDJM Event Management
In the same product, most dangerous first.
CVE-2022-1194—Mobile Events Manager < 1.4.8 - Admin+ CSV InjectionEPSS 1.3%CVE-2021-25049—Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2026-88802HIGHMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post DeletionEPSS 0.4%CVE-2026-88801HIGHMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role CreationEPSS —CVE-2026-88800CRITICALMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role DeletionEPSS —