CVE-2026-88800 in MDJM Event Management Plugin
Summary
by MITRE • 11/06/2026
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in MDJM Event Management and Mobile Events Manager WordPress plugins prior to version 1.7.8.7 represents a critical failure in access control logic that allows for the complete compromise of administrative privileges on affected sites. This flaw stems from an insecure direct object reference combined with a broken authorization mechanism, where the application processes role deletion requests without verifying the user's permissions or validating the integrity of the request through nonces. The core technical issue lies in the asynchronous handling of input parameters during the execution of the delete operation. Specifically, the code segment responsible for determining which role to remove reads one set of variables from the HTTP request, while a separate guard clause intended to prevent the deletion of roles containing active users reads a different part of that same request. This desynchronization creates a logic bypass where an attacker can manipulate specific parameters to satisfy the safety check while simultaneously targeting any other role for deletion.
From a technical perspective, this vulnerability is classified under CWE-269 Improper Privilege Management and CWE-352 Cross-Site Request Forgery due to the absence of anti-CSRF tokens. The lack of capability checks means that unauthenticated actors can interact with administrative functions as if they were logged-in administrators. Furthermore, because the guard mechanism relies on a different request parameter than the one dictating the deletion target, it fails to provide any meaningful protection against malicious input manipulation. An attacker does not need valid credentials or session cookies; they simply need to craft a specific HTTP request that exploits this parsing discrepancy. This allows for remote code execution in terms of administrative control, as deleting roles fundamentally alters the permission structure of the entire WordPress installation.
The operational impact of this vulnerability is severe and potentially catastrophic for website owners. By successfully exploiting this flaw, an attacker can delete any role within the system, including the Administrator role itself. When a role is deleted, all users associated with that role are instantly stripped of their capabilities and permissions. If the Administrator role is removed, every user on the site loses administrative access, effectively locking out legitimate administrators from managing the website. This results in a denial of service for site management functions and creates an opportunity for further exploitation if other vulnerabilities exist or if new roles can be created with elevated privileges by remaining active users who were not affected by the deletion. The permanence of this action means that recovery requires manual database intervention to restore role definitions, leading to significant downtime and data integrity concerns.
To mitigate this risk, immediate updates to version 1.7.8.7 or later are required for all installations using MDJM Event Management or Mobile Events Manager plugins. These updated versions address the logic flaw by ensuring that capability checks and nonce validations are applied consistently across all administrative actions involving role management. Administrators should also audit their user roles post-update to ensure no unintended deletions occurred if they were running a vulnerable version prior to patching. Additionally, implementing strict input validation and enforcing consistent parameter reading in backend operations is essential for preventing similar logic bugs in future development cycles. Regular security audits and the use of web application firewalls can provide an additional layer of defense by detecting anomalous requests that attempt to manipulate role structures without proper authentication tokens.