Skip to content

CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

CriticalCVSS 9.1
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry