---
id: "CVE-2026-88799"
page: "https://infrastack.ai/live/CVE-2026-88799"
kind: "vulnerability"
aliases: ["CVE-2026-88799"]
title: "WordPress MDJM event plugins let any logged-in user take over accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mobile-dj-manager (MDJM Event Management)", "fixed": [], "affected": "<= 1.7.8.7", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["mdj-event-management", "mobile-events-manager", "package", "wordpress"]
not_affected_if: ["plugin-newer-than-1.7.8.7", "plugin-not-installed"]
published_at: "2026-11-06T08:17:38+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:43:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88799", "first_seen_at": "2026-11-06T08:40:33+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/mobile-dj-manager/", "first_seen_at": "2026-11-06T08:43:45+00:00", "cites": ["https://wordpress.org/plugins/mobile-dj-manager/", "https://hol.org/guard/security/cves/CVE-2026-88799-mdjm-event-management-and-mobile-events-manager"]}]
exploit_sources: []
---

# WordPress MDJM event plugins let any logged-in user take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-88799 (this .md is for agents)

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 fail to check ownership on the profile update function, so any logged-in user, even a subscriber, can change another account's password and email. An attacker can use this to take over any account, including an administrator account, which gives full control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:mobile-dj-manager (MDJM Event Management) affected <= 1.7.8.7 fixed no fixed version listed

## How to check

- In WordPress admin under Plugins, look for MDJM Event Management (slug mobile-dj-manager) or Mobile Events Manager; 1.7.8.7 or earlier is affected.
- Also check for subscriber or client accounts you do not recognise, and for unexpected password or email changes on admin accounts.

## Fix

No patched version published as of 2026-11-06; newest changelog entry is 1.7.8.7, which is affected. Until a fix ships, deactivate the plugin or disable open user registration.

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88799
- 2026-11-06T08:43:45+00:00 analyst https://wordpress.org/plugins/mobile-dj-manager/ — No fixed version found. WordPress.org plugin page changelog (page last modified Sep 8 2026, so may be stale) lists 1.7.8.7 as newest and no fix for this IDOR; HOL record citing WPScan reports no fix. Mobile Events Manager is the same plugin family; no separate version seen. Recheck wordpress.org/plugins/mobile-dj-manager for a release above 1.7.8.7 and the WPScan entry d808129b-e0cc-400a-9c30-33a9d0e357e9 (not read). Nothing verified.

## Documents

- [advisory] MDJM Event Management - WordPress.org plugin page and changelog (latest 1.7.8.7) https://wordpress.org/plugins/mobile-dj-manager/
- [mentions] HOL Guard: CVE-2026-88799 record (cites WPScan, no fix reported) https://hol.org/guard/security/cves/CVE-2026-88799-mdjm-event-management-and-mobile-events-manager

## From the sources

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_