CVE-2026-88800

Full vulnerability record from the local CVENow database.

Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 08:17:38.283000

Last modified

2026-11-06 08:17:38.283000

View original CVE JSON

{
  "id": "CVE-2026-88800",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T08:17:38.283",
  "lastModified": "2026-11-06T08:17:38.283",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "MDJM Event Management",
          "defaultStatus": "unknown",
          "collectionURL": "https://wordpress.org/plugins",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.7.8.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Unknown",
          "product": "Mobile Events Manager",
          "defaultStatus": "unknown",
          "collectionURL": "https://wordpress.org/plugins",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.7.8.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ]
  },
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/",
      "source": "[email protected]"
    }
  ]
}