Privilege Escalation in MDJM Event Management Plugin for WordPress

CVE-2026-15017

What is CVE-2026-15017?

The MDJM Event Management plugin for WordPress contains a vulnerability that allows unauthenticated attackers to escalate privileges by manipulating user roles. This is facilitated through the absence of necessary capability checks and nonce verification in key functions. Attackers can exploit this vulnerability to endow any registered role with administrative capabilities, potentially compromising the entire WordPress site. The role-manipulation functions are exposed to the public without authentication checks, making it easy for malicious actors to gain unauthorized access and elevate their privileges.

References