CVE-2026-88802 in MDJM Event Management Plugin
Summary
by MITRE • 09/13/2026
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability affects two distinct WordPress plugins, MDJM Event Management prior to version 1.7.8.5 and Mobile Events Manager through version 1.4.8.3, which fail to implement adequate access control mechanisms during the deletion of playlist entries. This security flaw stems from a fundamental lack of validation regarding user permissions, request integrity, and data types when processing requests intended to remove items from event playlists. Specifically, the application logic does not verify whether the initiating user possesses the necessary administrative or author capabilities required for such destructive actions. Furthermore, it fails to validate nonces, which are critical tokens used to prevent Cross-Site Request Forgery attacks by ensuring that a request was intentionally initiated by an authenticated user on the site. The absence of these checks allows any actor with network access to the WordPress installation to execute deletion operations without prior authentication or authorization.
From a technical perspective, this represents a classic case of broken access control where the server-side logic trusts client-supplied input regarding which post ID should be deleted and how it should be processed. By not checking the capability associated with the current user session, the plugin effectively treats unauthenticated requests as if they were coming from an administrator or editor. The failure to verify nonces further exacerbates this issue by removing a key defense layer against CSRF attacks, meaning that malicious actors can craft forged links or forms that trigger deletion actions when visited by logged-in administrators who have previously authenticated with the site. Additionally, the lack of validation on the type of record means the system does not confirm whether the targeted ID corresponds to a valid post object before proceeding with the database operation, increasing the risk of unintended data loss if an invalid identifier is processed or if race conditions occur during concurrent requests.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the destructive scope of the action. Attackers can permanently delete arbitrary posts, pages, and media attachments associated with events managed by these plugins. Because the deletion bypasses the WordPress trash mechanism, the data removal is immediate and irreversible without external backups or database snapshots. This leads to a complete loss of availability for affected content and potentially disrupts event management workflows that rely on persistent record-keeping. For organizations using these plugins, this could result in significant reputational damage, financial loss due to canceled events, and increased operational overhead required to restore lost data from backup systems. The ability to delete media attachments also poses a risk of losing associated images or documents critical for event promotion and attendee information.
This vulnerability aligns with CWE-284 Improper Access Control, as the application fails to restrict access to resources based on user privileges. It is also closely related to CWE-352 Cross-Site Request Forgery due to the missing nonce validation that allows forged requests to be executed successfully. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1498 Network Denial of Service via resource exhaustion or destruction, specifically under sub-techniques involving data manipulation or deletion by unauthorized actors. It may also relate to T1530 Data from Cloud Storage Objects if media attachments are stored externally, though the primary vector is local database modification.
To mitigate this vulnerability, administrators should immediately update MDJM Event Management to version 1.7.8.5 or later and Mobile Events Manager to a version newer than 1.4.8.3 where these access control checks have been implemented by the developers. For sites that cannot upgrade immediately due to compatibility constraints, temporary mitigations include restricting access to the WordPress admin area via IP whitelisting if feasible, although this is less effective against CSRF vectors unless combined with strong authentication policies. Implementing a Web Application Firewall can also help detect and block suspicious deletion requests that lack valid nonces or originate from unexpected user agents. Regular auditing of plugin code for proper capability checks using functions like current_user_can and nonce verification via wp_verify_nonce is essential to prevent similar issues in future updates or other plugins. Ensuring regular database backups remains a critical operational practice to recover from any successful exploitation attempts until the software is patched.