{"id":"CVE-2026-88800","published":"2026-11-06T08:17:38.283","lastModified":"2026-11-06T08:17:38.283","description":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins (≤1.7.8.7) lack both capability checks and nonce validation on role deletion requests, and contain a logic flaw where the request parameter used to select roles for deletion differs from the one checked by the guard meant to protect roles with users, allowing unauthenticated attackers to delete any WordPress role—including administrator—permanently stripping affected users of their capabilities.","exploitability":"Exploitation is trivial for unauthenticated attackers due to the absence of capability checks and nonce validation; no authentication or user interaction is required.","blast_radius":"Successful exploitation permanently removes WordPress roles, potentially locking out all administrators and other privileged users, leading to complete site compromise and loss of administrative control until manual database recovery.","remediation":"Upgrade to MDJM Event Management and Mobile Events Manager plugin version 1.7.8.8 or later, which addresses the vulnerability by implementing proper nonce validation, capability checks, and correcting the role selection logic.","detection":"Look for HTTP POST requests to WordPress admin-ajax.php or wp-admin/admin-post.php containing a 'delete_role' parameter (or similar) without a valid _wpnonce, especially from unauthenticated IP addresses; repeated or anomalous role-deletion attempts in WordPress debug or error logs may also be observed.","tags":["auth-bypass","role-deletion","wordpress","unauthenticated","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:46:40.760Z"}}