MOBILE-DJ-MANAGER · CVE-2026-88800 · Package
NO FIX YET · SEE WHAT TO DO
The MDJM Event Management and Mobile Events Manager WordPress plugins run a role deletion on every page load without a capability check or nonce. An unauthenticated attacker can remove any WordPress role, including administrator, which strips every user with that role of its capabilities.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site with MDJM Event Management (mobile-dj-manager) or Mobile Events Manager active at 1.7.8.7 or earlier. The role deletion runs on ordinary page loads with no login, so no special configuration is needed per the NVD description. Sites without either plugin can skip it. No fixed release was found on the WordPress.org changelog, whose newest entry is 1.7.8.7.
Not affected if plugin-above-1.7.8.7, plugin-not-installed
Who cares mdjm-event-management, mobile-events-manager, wordpress
1.7.8.7 is the latest release on the WordPress.org changelog and is the affected versionThe MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.