CVE-2026-88800: MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it. No WordPress account, capability, or valid nonce is required.

Q: Are standard installations exposed?

Any site using either affected plugin version through 1.7.8.7 is exposed because the role-deletion logic runs on every page load and lacks authorization checks.

Q: What is the practical impact of a successful attack?

An attacker can delete any WordPress role, including the administrator role. Deleting a role permanently removes the capabilities associated with it from every user assigned that role.

Q: What should teams do if they cannot patch immediately?

The provided information does not identify a configuration workaround. Restricting access to the affected site while remediation is arranged may reduce exposure, since exploitation can be performed without authentication.

Q: How can administrators check whether they have already been affected?

Review the site's WordPress roles and user capability assignments, especially whether the administrator role is missing or administrator users no longer retain their expected capabilities.

Published Nov 6, 2026

Updated

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it. No WordPress account, capability, or valid nonce is required.

Are standard installations exposed?

Any site using either affected plugin version through 1.7.8.7 is exposed because the role-deletion logic runs on every page load and lacks authorization checks.

What is the practical impact of a successful attack?

An attacker can delete any WordPress role, including the administrator role. Deleting a role permanently removes the capabilities associated with it from every user assigned that role.

What should teams do if they cannot patch immediately?

The provided information does not identify a configuration workaround. Restricting access to the affected site while remediation is arranged may reduce exposure, since exploitation can be performed without authentication.

How can administrators check whether they have already been affected?

Review the site's WordPress roles and user capability assignments, especially whether the administrator role is missing or administrator users no longer retain their expected capabilities.

CVE-2026-88800: MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

Event History

Frequently Asked Questions

Who can exploit this issue?

Are standard installations exposed?

What is the practical impact of a successful attack?

What should teams do if they cannot patch immediately?

How can administrators check whether they have already been affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are standard installations exposed?

What is the practical impact of a successful attack?

What should teams do if they cannot patch immediately?

How can administrators check whether they have already been affected?