CVE-2026-88799

Summary

The MDJM Event Management and Mobile Events Manager WordPress plugins (≤1.7.8.7) lack authorization checks when updating client profile information, allowing any authenticated user—including low-privileged ones like subscribers—to modify critical profile fields such as password and email for any other account, including administrators, leading to full account takeover.

Exploitability

Exploitation is trivial: any authenticated user with a valid WordPress session can send a crafted request to the profile update endpoint without needing elevated privileges or additional conditions.

Blast radius

Successful exploitation grants attackers full control over any targeted account—including administrative accounts—enabling data theft, privilege escalation, lateral movement, and persistent backdoor access across the site.

Detection

Monitor WordPress debug logs or audit log plugins (e.g., WP Activity Log) for unexpected changes to user email addresses or passwords by low-privilege users (e.g., subscribers); also watch for repeated profile update requests targeting high-privilege user IDs from non-administrative sessions.

Prioritized remediation

Upgrade to MDJM Event Management plugin version 1.7.8.8 or later, which includes proper capability and ownership checks for profile update operations.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.