CVE-2026-88800

Summary

The MDJM Event Management and Mobile Events Manager WordPress plugins (≤1.7.8.7) lack both capability checks and nonce validation on role deletion requests, and contain a logic flaw where the request parameter used to select roles for deletion differs from the one checked by the guard meant to protect roles with users, allowing unauthenticated attackers to delete any WordPress role—including administrator—permanently stripping affected users of their capabilities.

Exploitability

Exploitation is trivial for unauthenticated attackers due to the absence of capability checks and nonce validation; no authentication or user interaction is required.

Blast radius

Successful exploitation permanently removes WordPress roles, potentially locking out all administrators and other privileged users, leading to complete site compromise and loss of administrative control until manual database recovery.

Detection

Look for HTTP POST requests to WordPress admin-ajax.php or wp-admin/admin-post.php containing a 'delete_role' parameter (or similar) without a valid _wpnonce, especially from unauthenticated IP addresses; repeated or anomalous role-deletion attempts in WordPress debug or error logs may also be observed.

Prioritized remediation

Upgrade to MDJM Event Management and Mobile Events Manager plugin version 1.7.8.8 or later, which addresses the vulnerability by implementing proper nonce validation, capability checks, and correcting the role selection logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.