{"id":"CVE-2026-88799","kind":"vulnerability","aliases":["CVE-2026-88799"],"related":[],"title":"WordPress MDJM event plugins let any logged-in user take over accounts","description":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 fail to check ownership on the profile update function, so any logged-in user, even a subscriber, can change another account's password and email. An attacker can use this to take over any account, including an administrator account, which gives full control of the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mobile-dj-manager (MDJM Event Management)","fixed":[],"affected":"<= 1.7.8.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mdj-event-management","mobile-events-manager","package","wordpress"],"not_affected_if":["plugin-newer-than-1.7.8.7","plugin-not-installed"],"how_to_check":"- In WordPress admin under Plugins, look for MDJM Event Management (slug mobile-dj-manager) or Mobile Events Manager; 1.7.8.7 or earlier is affected.\n- Also check for subscriber or client accounts you do not recognise, and for unexpected password or email changes on admin accounts.","fix":"No patched version published as of 2026-11-06; newest changelog entry is 1.7.8.7, which is affected. Until a fix ships, deactivate the plugin or disable open user registration.","status":"open","published_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:27+00:00","updated_at":"2026-11-06T08:43:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T08:42:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress MDJM event plugins let any logged-in user take over accounts","impact":"high","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 fail to check ownership on the profile update function, so any logged-in user, even a subscriber, can change another account's password and email. An attacker can use this to take over any account, including an administrator account, which gives full control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mdj-event-management","mobile-events-manager"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over any account, including administrators, and the site","analyst_note":"Find the fixed plugin version and the vendor advisory; the sources only give the affected range through 1.7.8.7.","how_to_check":"- Check whether the `MDJM Event Management` or `Mobile Events Manager` plugin is installed and its version in the WordPress admin under Plugins.\n- Treat any version `1.7.8.7` or earlier as exposed.\n- Unknown whether the sources list a fixed version.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.7.8.7"],"who_is_affected":"Any WordPress site running the MDJM Event Management or Mobile Events Manager plugin at version 1.7.8.7 or earlier is exposed. The flaw needs only a logged-in account of any role, such as a subscriber, so sites that allow open registration are at most risk. Sites without these plugins can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4237,"output_tokens":614,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and the vendor advisory; the sources only give the affected range through 1.7.8.7.","search":"'-2026':15A,18A '-88799':16A,19A '1.7.8.7':48B,107C 'account':13A,70B,84B,88B,141C,149C 'address':137C 'administr':87B,144C 'allow':123C 'anoth':69B 'attack':76B 'authent':125C 'capabl':113C 'chang':68B,132C 'check':51B,110C 'client':120C 'control':92B 'cve':14A,17A 'dj':22A 'email':74B,136C 'even':64B 'event':3A,25A,29B,33B,39B,43B,98C,102C 'fail':49B 'full':91B,148C 'function':57B 'give':90B 'identifi':116C 'includ':85B,142C 'let':5A 'log':8A,61B 'logged-in':7A,60B 'manag':30B,34B,40B,44B,99C,103C 'management':26A 'manager':23A 'mdj':28B 'mdj-event-manag':27B 'mdjm':2A,24A,38B,97C 'mobil':32B,42B,101C 'mobile':21A 'mobile-dj-manager':20A 'mobile-events-manag':31B 'ownership':52B,111C 'packag':35B 'password':72B,134C 'plugin':4A,46B,105C 'profil':55B,121C 'result':145C 'site':95B 'subscrib':66B,130C 'suppli':117C 'take':11A,81B 'takeov':150C 'updat':56B,122C 'use':78B 'user':10A,63B,126C 'wordpress':1A,36B,45B,104C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the MDJM Event Management or Mobile Events Manager plugin at version 1.7.8.7 or earlier is exposed. The flaw needs only a logged-in account of any role, such as a subscriber, so sites that allow open registration are at most risk. Sites without these plugins can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mdjmeventmanagement","mobiledjmanagermdjmeventmanagement"],"ptokens":["dj","event","management","manager","mdjm","mobile"],"labels":["high","mdjeventmanagement","mobileeventsmanager","package","wordpress"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88799':16A,19A 'account':13A 'cve':14A,17A 'dj':22A 'event':3A,25A 'let':5A 'log':8A 'logged-in':7A 'management':26A 'manager':23A 'mdjm':2A,24A 'mobile':21A 'mobile-dj-manager':20A 'plugin':4A 'take':11A 'user':10A 'wordpress':1A","search_b":"'1.7.8.7':48B 'account':70B,84B,88B 'administr':87B 'anoth':69B 'attack':76B 'chang':68B 'check':51B 'control':92B 'email':74B 'even':64B 'event':29B,33B,39B,43B 'fail':49B 'full':91B 'function':57B 'give':90B 'includ':85B 'log':61B 'logged-in':60B 'manag':30B,34B,40B,44B 'mdj':28B 'mdj-event-manag':27B 'mdjm':38B 'mobil':32B,42B 'mobile-events-manag':31B 'ownership':52B 'packag':35B 'password':72B 'plugin':46B 'profil':55B 'site':95B 'subscrib':66B 'take':81B 'updat':56B 'use':78B 'user':63B 'wordpress':36B,45B","search_c":"'1.7.8.7':107C 'account':141C,149C 'address':137C 'administr':144C 'allow':123C 'authent':125C 'capabl':113C 'chang':132C 'check':110C 'client':120C 'email':136C 'event':98C,102C 'full':148C 'identifi':116C 'includ':142C 'manag':99C,103C 'mdjm':97C 'mobil':101C 'ownership':111C 'password':134C 'plugin':105C 'profil':121C 'result':145C 'subscrib':130C 'suppli':117C 'takeov':150C 'updat':122C 'user':126C 'wordpress':104C","first_public_at":"2026-11-06T08:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88799","severity":null,"published_at":"2026-11-06T08:17:38+00:00","modified_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88799:1876","url":"https://wordpress.org/plugins/mobile-dj-manager/","severity":null,"published_at":"2026-11-06T08:43:45+00:00","modified_at":"2026-11-06T08:43:45+00:00","first_seen_at":"2026-11-06T08:43:45+00:00","fetched_at":"2026-11-06T08:43:45+00:00","note":"No fixed version found. WordPress.org plugin page changelog (page last modified Sep 8 2026, so may be stale) lists 1.7.8.7 as newest and no fix for this IDOR; HOL record citing WPScan reports no fix. Mobile Events Manager is the same plugin family; no separate version seen. Recheck wordpress.org/plugins/mobile-dj-manager for a release above 1.7.8.7 and the WPScan entry d808129b-e0cc-400a-9c30-33a9d0e357e9 (not read). Nothing verified.","cites":["https://wordpress.org/plugins/mobile-dj-manager/","https://hol.org/guard/security/cves/CVE-2026-88799-mdjm-event-management-and-mobile-events-manager"]}],"documents":[{"id":84928,"url":"https://wordpress.org/plugins/mobile-dj-manager/","title":"MDJM Event Management - WordPress.org plugin page and changelog (latest 1.7.8.7)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84929,"url":"https://hol.org/guard/security/cves/CVE-2026-88799-mdjm-event-management-and-mobile-events-manager","title":"HOL Guard: CVE-2026-88799 record (cites WPScan, no fix reported)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}