Role Deletion Flaw in MDJM Event Management and Mobile Events Manager WordPress Plugins
CVE-2026-88800

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
Mdjm Event Management
Mobile Events Manager
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-88800?

A vulnerability exists in the MDJM Event Management and Mobile Events Manager WordPress plugins that allows unauthorized users to execute role deletion requests on every page load. This security issue arises because the plugin does not perform any capability checks or validate requests using a nonce. Consequently, an unauthenticated attacker can exploit this flaw to delete any WordPress role, including the administrator role, effectively removing user capabilities and compromising the entire site. This creates a significant security risk for websites relying on these plugins, as it undermines user management and access control.

Affected Version(s)

MDJM Event Management 0 <= 1.7.8.7

Mobile Events Manager 0 <= 1.7.8.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88800 - Proof of Concept

References

https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem (cyberkareem)
WPScan
.