CVE-2026-88800
CRITICAL
INFO
Priority: 0.03
BB Relevance:
78/100
Published: 2026-11-06
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
High
A:
High
Description
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| Unknown | MDJM Event Management | 0 |
| Unknown | MDJM Event Management | 0 |
| Unknown | Mobile Events Manager | 0 |
| Unknown | Mobile Events Manager | 0 |
References & Advisories (1)
exploit
vdb-entry
technical-description