Junglewise Threat Intelligence

CVE-2026-15017: MDJM Event Management privilege escalation in WordPress plugin

CVE-2026-15017 · Severity: high · CVSS 8.8 · Published 2026-07-23

Technologies: MDJM Event Management. Vendors: MDJM.

Executive brief

The MDJM Event Management plugin for WordPress, used for managing event bookings and staff, contains a security flaw that allows users with low-level access to take over the entire website. By exploiting missing security checks, an attacker can elevate their account permissions to that of an Administrator. This could lead to a total loss of control over the site, data theft, or service disruption.

Technical details

The MDJM Event Management plugin for WordPress is vulnerable to privilege escalation in versions up to 1.7.8.4. This is caused by missing capability checks and nonce verification in the MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init() functions. Additionally, the plugin fails to validate the employee_roles[] and new_role POST parameters against an allow-list before passing them to mdjm_set_employee_role() and WP_User::set_role(). Because MDJM_Permissions::init() is hooked into the public WordPress 'init' action without authentication, unauthenticated attackers can modify role capabilities. A subscriber-level user can then leverage these modified capabilities to escalate their privileges to Administrator.

Affected products

  • MDJM MDJM Event Management up to, and including, 1.7.8.4

Timeline

  • 2026-07-23: disclosed
  • 2026-07-23: advisory

References

Related threats