---
id: "CVE-2026-88800"
page: "https://infrastack.ai/live/CVE-2026-88800"
kind: "vulnerability"
aliases: ["CVE-2026-88800"]
title: "WordPress MDJM event plugins let anyone delete the administrator role"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mobile-dj-manager", "fixed": [], "affected": "<= 1.7.8.7", "ecosystem": "wordpress"}, {"name": "mobile-events-manager", "fixed": [], "affected": "<= 1.7.8.7", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["mdjm-event-management", "mobile-events-manager", "package", "wordpress"]
not_affected_if: ["plugin-above-1.7.8.7", "plugin-not-installed"]
published_at: "2026-11-06T08:17:38+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:43:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88800", "first_seen_at": "2026-11-06T08:40:33+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/mobile-dj-manager/", "first_seen_at": "2026-11-06T08:43:54+00:00", "cites": ["https://wordpress.org/plugins/mobile-dj-manager/", "https://nvd.nist.gov/vuln/detail/CVE-2026-88800", "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mobile-events-manager"]}]
exploit_sources: []
---

# WordPress MDJM event plugins let anyone delete the administrator role

Link for people: https://infrastack.ai/live/CVE-2026-88800 (this .md is for agents)

The MDJM Event Management and Mobile Events Manager WordPress plugins run a role deletion on every page load without a capability check or nonce. An unauthenticated attacker can remove any WordPress role, including administrator, which strips every user with that role of its capabilities.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:mobile-dj-manager affected <= 1.7.8.7 fixed no fixed version listed
- wordpress:mobile-events-manager affected <= 1.7.8.7 fixed no fixed version listed

## How to check

- WordPress admin > Plugins: look for MDJM Event Management (slug mobile-dj-manager) or Mobile Events Manager (slug mobile-events-manager) at version 1.7.8.7 or lower
- WP-CLI: wp plugin list --name=mobile-dj-manager --fields=name,status,version (repeat for mobile-events-manager)
- Check the administrator role still exists: wp role list. If it is missing, restore it (wp role reset administrator) and check your logs for unauthenticated requests

## Fix

No fixed version known: 1.7.8.7 is the latest release on the WordPress.org changelog and is the affected version. Until a patch ships, deactivate and remove the plugin, or block unauthenticated role-deletion requests at a WAF.

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88800
- 2026-11-06T08:43:54+00:00 analyst https://wordpress.org/plugins/mobile-dj-manager/ — NVD page not retrievable via web-cli (empty); description from signal. WordPress.org changelog top entry is 1.7.8.7 = affected version, so no fix known; Mobile Events Manager removed from wordpress.org per Wordfence. Sibling CVE-2026-88802 fixed in 1.7.8.5 is a different bug. No PoC or exploitation found. Not verified: no vendor advisory text read.

## Documents

- [advisory] MDJM Event Management - WordPress.org plugin page and changelog (latest 1.7.8.7) https://wordpress.org/plugins/mobile-dj-manager/
- [advisory] NVD CVE-2026-88800 https://nvd.nist.gov/vuln/detail/CVE-2026-88800
- [mentions] Wordfence: Mobile Events Manager (status Removed from wordpress.org) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mobile-events-manager

## From the sources

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_