# CVE-2026-88799: MDJM Event Management and Mobile Events Manager account takeover via IDOR

Source: https://junglewise.ai/threats/cve-2026-88799-the-mdjm-event-management-and-mobile-events-manager-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-88799 · Severity: high · CVSS 8.8 · Published 2026-11-06

MDJM Event Management and Mobile Events Manager are WordPress plugins used to manage event bookings and client profiles for DJs and event planners. An authenticated attacker with minimal privileges (such as a subscriber account) can exploit an access control flaw to take over any other account, including administrator accounts, by changing passwords and email addresses. This allows complete compromise of WordPress sites using these plugins.

Technologies: [MDJM Event Management](https://junglewise.ai/threats/technologies/mdjm-event-management), [MDJM Mobile Events Manager](https://junglewise.ai/threats/technologies/mdjm-mobile-events-manager). Vendors: [MDJM](https://junglewise.ai/threats/vendors/mdjm).

## Quick answers

**Is CVE-2026-88799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88799 being exploited in the wild.

**How severe is CVE-2026-88799?** High severity, with a CVSS score of 8.8, published 6 November 2026.

**Which products and versions are affected?** MDJM Event Management through 1.7.8.7; MDJM Mobile Events Manager through 1.7.8.7.

**Is there a fix for CVE-2026-88799?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88799 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88799?** Check whether you run MDJM Event Management or MDJM Mobile Events Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugins fail to validate ownership or check user capabilities before processing client profile update requests, resulting in an Insecure Direct Object Reference (IDOR) vulnerability. Any authenticated user can supply an arbitrary client identifier and modify another user's password and email address. The attack requires only a valid WordPress account (even a subscriber role) and network access to the WordPress site.

## Affected products

- MDJM Event Management through 1.7.8.7
- MDJM Mobile Events Manager through 1.7.8.7

## Timeline

- 2026-11-02: disclosed
- 2026-11-06: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/d808129b-e0cc-400a-9c30-33a9d0e357e9/](https://wpscan.com/vulnerability/d808129b-e0cc-400a-9c30-33a9d0e357e9/)

## Related threats

- [MDJM Event Management stored XSS in role creation](https://junglewise.ai/threats/cve-2026-88801-the-mdjm-event-management-and-mobile-events-manager-wordpress)
- [WordPress MDJM Event Management and Mobile Events Manager arbitrary role deletion](https://junglewise.ai/threats/cve-2026-88800-the-mdjm-event-management-and-mobile-events-manager-wordpress)
- [MDJM Event Management unauthenticated post deletion](https://junglewise.ai/threats/cve-2026-88802-mdjm-event-management-unauthenticated-post-deletion)