Vulnerability details
CVE-2026-88800
MDJM Event ManagementMobile Events Manager
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion
CVSS 3.1
9.1Critical
Official description
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.1 | CVEProject cvelistV5 (CNA) (WPScan) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | MDJM Event Management | v ≤ 1.7.8.7 | CVEProject cvelistV5 (CNA) |
| — | Mobile Events Manager | v ≤ 1.7.8.7 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-06
- Last updated
- 2026-11-06
- State
- Published
- Assigner (CNA)
- WPScan
- Kolun priority
- 30 · Low
Exploit prediction (EPSS)
0.3%
Probability of exploitation in 30 days
23.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-862Missing Authorization