Is CVE-2026-15017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15017 being exploited in the wild.

How severe is CVE-2026-15017?

High severity, with a CVSS score of 8.8, published 23 July 2026.

Which products and versions are affected?

MDJM Event Management up to, and including, 1.7.8.4.

Is there a fix for CVE-2026-15017?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15017 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15017?

Check whether you run MDJM Event Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15017: MDJM Event Management privilege escalation in WordPress plugin

CVE-2026-15017 · Severity: high · CVSS 8.8 · Published 2026-07-23

The MDJM Event Management plugin for WordPress, used for managing event bookings and staff, contains a security flaw that allows users with low-level access to take over the entire website. By exploiting missing security checks, an attacker can elevate their account permissions to that of an Administrator. This could lead to a total loss of control over the site, data theft, or service disruption.

Technologies: MDJM Event Management. Vendors: MDJM.

Quick answers

Is CVE-2026-15017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15017 being exploited in the wild.
How severe is CVE-2026-15017?: High severity, with a CVSS score of 8.8, published 23 July 2026.
Which products and versions are affected?: MDJM Event Management up to, and including, 1.7.8.4.
Is there a fix for CVE-2026-15017?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15017 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15017?: Check whether you run MDJM Event Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MDJM Event Management plugin for WordPress is vulnerable to privilege escalation in versions up to 1.7.8.4. This is caused by missing capability checks and nonce verification in the MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init() functions. Additionally, the plugin fails to validate the employee_roles[] and new_role POST parameters against an allow-list before passing them to mdjm_set_employee_role() and WP_User::set_role(). Because MDJM_Permissions::init() is hooked into the public WordPress 'init' action without authentication, unauthenticated attackers can modify role capabilities. A subscriber-level user can then leverage these modified capabilities to escalate their privileges to Administrator.

Affected products

MDJM MDJM Event Management up to, and including, 1.7.8.4

Timeline

2026-07-23: disclosed
2026-07-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.