CVE-2026-88800criticalCWE-862

CVE-2026-88800: critical vulnerability in MDJM Event Management

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

Published

Follow this CVE+ Monitor Mobile Events Manager+ Monitor MDJM Event Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.1epss 0.3%
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
Unknown · MDJM Event ManagementUnknown · Mobile Events Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MDJM Event Management

In the same product, most dangerous first.

CVE-2022-1194—Mobile Events Manager < 1.4.8 - Admin+ CSV InjectionEPSS 1.3%CVE-2021-25049—Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2026-88802HIGHMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post DeletionEPSS 0.4%CVE-2026-88799HIGHMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOREPSS 0.3%CVE-2026-88801HIGHMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role CreationEPSS 0.3%