{"id":"CVE-2026-88800","kind":"vulnerability","aliases":["CVE-2026-88800"],"related":[],"title":"WordPress MDJM event plugins let anyone delete the administrator role","description":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins run a role deletion on every page load without a capability check or nonce. An unauthenticated attacker can remove any WordPress role, including administrator, which strips every user with that role of its capabilities.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mobile-dj-manager","fixed":[],"affected":"<= 1.7.8.7","ecosystem":"wordpress"},{"name":"mobile-events-manager","fixed":[],"affected":"<= 1.7.8.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mdjm-event-management","mobile-events-manager","package","wordpress"],"not_affected_if":["plugin-above-1.7.8.7","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for MDJM Event Management (slug mobile-dj-manager) or Mobile Events Manager (slug mobile-events-manager) at version 1.7.8.7 or lower\n- WP-CLI: wp plugin list --name=mobile-dj-manager --fields=name,status,version (repeat for mobile-events-manager)\n- Check the administrator role still exists: wp role list. If it is missing, restore it (wp role reset administrator) and check your logs for unauthenticated requests","fix":"No fixed version known: 1.7.8.7 is the latest release on the WordPress.org changelog and is the affected version. Until a patch ships, deactivate and remove the plugin, or block unauthenticated role-deletion requests at a WAF.","status":"open","published_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:30+00:00","updated_at":"2026-11-06T08:43:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T08:42:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress MDJM event plugins let anyone delete the administrator role","impact":"high","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins run a role deletion on every page load without a capability check or nonce. An unauthenticated attacker can remove any WordPress role, including administrator, which strips every user with that role of its capabilities.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mdjm-event-management","mobile-events-manager"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Administrator role deleted, all admins lose capabilities","analyst_note":"Confirm a fixed plugin version and whether the NVD entry lists the affected range; the sources give only 'through 1.7.8.7'.","how_to_check":"- Check whether the plugin `mobile-events-manager` or the MDJM Event Management plugin is installed and its version in the WordPress admin under Plugins\n- Look for a version at or below `1.7.8.7` in the plugin header\n- Check that the `administrator` role still exists and that admin users can still log in","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-1.7.8.7"],"who_is_affected":"Sites running the MDJM Event Management or Mobile Events Manager WordPress plugins at version 1.7.8.7 or earlier are exposed, because the role deletion runs on ordinary page loads for any visitor. The sources do not say which configuration is needed, and they do not name a fixed version. Sites without these plugins are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000734,"input_tokens":4270,"output_tokens":614,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm a fixed plugin version and whether the NVD entry lists the affected range; the sources give only 'through 1.7.8.7'.","search":"'-2026':12A,15A '-88800':13A,16A '1.7.8.7':90C 'act':91C 'administr':9A,68B,143C 'allow':134C 'anyon':6A 'assign':118C 'attack':61B,136C 'capabl':55B,78B,103C,151C 'check':56B,104C 'cve':11A,14A 'delet':7A,48B,95C,133C 'differ':121C 'dj':19A 'event':3A,27B,31B,37B,41B,81C,85C 'events':23A 'everi':50B,71B,98C,147C 'guard':110C 'includ':67B,142C 'let':5A 'load':52B,100C 'manag':28B,32B,38B,42B,82C,86C 'manager':20A,24A 'mdjm':2A,26B,36B,80C 'mdjm-event-manag':25B 'meant':111C 'mobil':30B,40B,84C 'mobile':18A,22A 'mobile-dj-manager':17A 'mobile-events-manag':29B 'mobile-events-manager':21A 'nonc':58B,107C 'one':128C 'packag':33B 'page':51B,99C 'part':122C 'perman':145C 'plugin':4A,44B,88C 'protect':113C 'read':119C 'remov':63B,138C 'request':96C,125C 'role':10A,47B,66B,75B,94C,114C,141C 'run':45B 'select':130C 'strip':70B,146C 'unauthent':60B,135C 'user':72B,117C,148C 'without':53B 'wordpress':1A,34B,43B,65B,87C,140C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with MDJM Event Management (mobile-dj-manager) or Mobile Events Manager active at 1.7.8.7 or earlier. The role deletion runs on ordinary page loads with no login, so no special configuration is needed per the NVD description. Sites without either plugin can skip it. No fixed release was found on the WordPress.org changelog, whose newest entry is 1.7.8.7.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mobiledjmanager","mobileeventsmanager"],"ptokens":["dj","events","manager","mobile"],"labels":["critical","mdjmeventmanagement","mobileeventsmanager","package","wordpress"],"campaign_type":null,"search_a":"'-2026':12A,15A '-88800':13A,16A 'administr':9A 'anyon':6A 'cve':11A,14A 'delet':7A 'dj':19A 'event':3A 'events':23A 'let':5A 'manager':20A,24A 'mdjm':2A 'mobile':18A,22A 'mobile-dj-manager':17A 'mobile-events-manager':21A 'plugin':4A 'role':10A 'wordpress':1A","search_b":"'administr':68B 'attack':61B 'capabl':55B,78B 'check':56B 'delet':48B 'event':27B,31B,37B,41B 'everi':50B,71B 'includ':67B 'load':52B 'manag':28B,32B,38B,42B 'mdjm':26B,36B 'mdjm-event-manag':25B 'mobil':30B,40B 'mobile-events-manag':29B 'nonc':58B 'packag':33B 'page':51B 'plugin':44B 'remov':63B 'role':47B,66B,75B 'run':45B 'strip':70B 'unauthent':60B 'user':72B 'without':53B 'wordpress':34B,43B,65B","search_c":"'1.7.8.7':90C 'act':91C 'administr':143C 'allow':134C 'assign':118C 'attack':136C 'capabl':103C,151C 'check':104C 'delet':95C,133C 'differ':121C 'event':81C,85C 'everi':98C,147C 'guard':110C 'includ':142C 'load':100C 'manag':82C,86C 'mdjm':80C 'meant':111C 'mobil':84C 'nonc':107C 'one':128C 'page':99C 'part':122C 'perman':145C 'plugin':88C 'protect':113C 'read':119C 'remov':138C 'request':96C,125C 'role':94C,114C,141C 'select':130C 'strip':146C 'unauthent':135C 'user':117C,148C 'wordpress':87C,140C","first_public_at":"2026-11-06T08:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88800","severity":null,"published_at":"2026-11-06T08:17:38+00:00","modified_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88800:1873","url":"https://wordpress.org/plugins/mobile-dj-manager/","severity":null,"published_at":"2026-11-06T08:43:54+00:00","modified_at":"2026-11-06T08:43:54+00:00","first_seen_at":"2026-11-06T08:43:54+00:00","fetched_at":"2026-11-06T08:43:54+00:00","note":"NVD page not retrievable via web-cli (empty); description from signal. WordPress.org changelog top entry is 1.7.8.7 = affected version, so no fix known; Mobile Events Manager removed from wordpress.org per Wordfence. Sibling CVE-2026-88802 fixed in 1.7.8.5 is a different bug. No PoC or exploitation found. Not verified: no vendor advisory text read.","cites":["https://wordpress.org/plugins/mobile-dj-manager/","https://nvd.nist.gov/vuln/detail/CVE-2026-88800","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mobile-events-manager"]}],"documents":[{"id":84928,"url":"https://wordpress.org/plugins/mobile-dj-manager/","title":"MDJM Event Management - WordPress.org plugin page and changelog (latest 1.7.8.7)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84933,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88800","title":"NVD CVE-2026-88800","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84934,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mobile-events-manager","title":"Wordfence: Mobile Events Manager (status Removed from wordpress.org)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}