{"id":"CVE-2026-88799","published":"2026-11-06T08:17:38.130","lastModified":"2026-11-06T08:17:38.130","description":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d808129b-e0cc-400a-9c30-33a9d0e357e9/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins (≤1.7.8.7) lack authorization checks when updating client profile information, allowing any authenticated user—including low-privileged ones like subscribers—to modify critical profile fields such as password and email for any other account, including administrators, leading to full account takeover.","exploitability":"Exploitation is trivial: any authenticated user with a valid WordPress session can send a crafted request to the profile update endpoint without needing elevated privileges or additional conditions.","blast_radius":"Successful exploitation grants attackers full control over any targeted account—including administrative accounts—enabling data theft, privilege escalation, lateral movement, and persistent backdoor access across the site.","remediation":"Upgrade to MDJM Event Management plugin version 1.7.8.8 or later, which includes proper capability and ownership checks for profile update operations.","detection":"Monitor WordPress debug logs or audit log plugins (e.g., WP Activity Log) for unexpected changes to user email addresses or passwords by low-privilege users (e.g., subscribers); also watch for repeated profile update requests targeting high-privilege user IDs from non-administrative sessions.","tags":["account-takeover","authorization-bypass","wordpress","plugin-vulnerability","low-privilege-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:56:04.712Z"}}