CVE-2026-88800— MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion
Quick assessment
Affected
Unknown MDJM Event Management
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MDJM Event Management 和 Mobile Events Manager WordPress 插件（版本 1.7.8.7 及以下）在每次页面加载时都会执行角色删除请求，且未进行权限检查，也未验证 nonce（一次性令牌）。此外，旨在保护已分配用户角色的防护机制读取的是请求中的不同部分，而角色删除操作依据的是另一部分数据。这种不一致导致未经身份验证的攻击者能够删除任何 WordPress 角色（包括管理员角色），从而永久剥夺所有用户的操作权限。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88800
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | MDJM Event Management | 0 ~ 1.7.8.7 | - |
|
| Unknown | Mobile Events Manager | 0 ~ 1.7.8.7 | - |
|
II. Public POCs for CVE-2026-88800
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88800
请登录查看更多情报信息。
Other References for CVE-2026-88800 (1)
-
https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total
| CVE-2026-118423 | 10.0 CRITICAL | WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload |
| CVE-2026-88799 | 8.8 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover |
| CVE-2026-88801 | 8.0 HIGH | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro |
| CVE-2026-121633 | 5.3 MEDIUM | Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste |
| CVE-2026-121636 | 5.3 MEDIUM | Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the |
| CVE-2026-118166 | 4.8 MEDIUM | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution vi |
| CVE-2026-113615 | GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi | |
| CVE-2026-118239 | AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth | |
| CVE-2026-118188 | PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure | |
| CVE-2026-115673 | Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email | |
| CVE-2026-118167 | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override | |
| CVE-2026-118187 | PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR | |
| CVE-2026-118186 | PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi | |
| CVE-2026-86606 | iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser | |
| CVE-2026-110813 | Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam | |
| CVE-2026-110525 | MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent | |
| CVE-2026-92396 | Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css | |
| CVE-2026-12967 | WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass | |
| CVE-2026-87784 | Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission | |
| CVE-2026-119259 | All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: MDJM Event Management
-
CVE-2026-88801
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - -
CVE-2026-88799
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - -
CVE-2026-88802
MDJM Event Management and Mobile Events Manager - Unauthenti -
CVE-2026-15017
MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber -
CVE-2026-7537
MDJM Event Management <= 1.7.8.3 - Authenticated (Administra
Same vendor: Unknown
-
CVE-2026-121636
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IP -
CVE-2026-121633
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmatio -
CVE-2026-118166
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Ar -
CVE-2026-118423
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary Fi -
CVE-2026-88801
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 -