CVE-2026-88799

Full vulnerability record from the local CVENow database.

Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 08:17:38.130000

Last modified

2026-11-06 08:17:38.130000

View original CVE JSON

{
  "id": "CVE-2026-88799",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T08:17:38.130",
  "lastModified": "2026-11-06T08:17:38.130",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "MDJM Event Management",
          "defaultStatus": "unknown",
          "collectionURL": "https://wordpress.org/plugins",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.7.8.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Unknown",
          "product": "Mobile Events Manager",
          "defaultStatus": "unknown",
          "collectionURL": "https://wordpress.org/plugins",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.7.8.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/d808129b-e0cc-400a-9c30-33a9d0e357e9/",
      "source": "[email protected]"
    }
  ]
}