# CVE-2026-88800: WordPress MDJM Event Management and Mobile Events Manager arbitrary role deletion

Source: https://junglewise.ai/threats/cve-2026-88800-the-mdjm-event-management-and-mobile-events-manager-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-88800 · Severity: critical · CVSS 9.1 · Published 2026-11-06

Two WordPress plugins for event management allow unauthenticated attackers to delete any WordPress user role, including administrator, by exploiting a missing authorization check on every page load. An attacker can permanently strip all users of their capabilities, rendering the WordPress site unusable and locking out legitimate administrators.

Technologies: [MDJM Event Management](https://junglewise.ai/threats/technologies/mdjm-event-management), [MDJM Mobile Events Manager](https://junglewise.ai/threats/technologies/mdjm-mobile-events-manager). Vendors: [MDJM](https://junglewise.ai/threats/vendors/mdjm).

## Quick answers

**Is CVE-2026-88800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88800 being exploited in the wild.

**How severe is CVE-2026-88800?** Critical severity, with a CVSS score of 9.1, published 6 November 2026.

**Which products and versions are affected?** MDJM Event Management through 1.7.8.7; MDJM Mobile Events Manager through 1.7.8.7.

**Is there a fix for CVE-2026-88800?** Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88800 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88800?** Check whether you run MDJM Event Management or MDJM Mobile Events Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

## Technical details

The plugins process role deletion requests on every page load without capability checks, nonce validation, or authentication. A logic flaw in the role-protection guard checks a different part of the request than the one that determines which role is deleted, allowing the protection to be bypassed. Unauthenticated network attackers can trigger role deletion by crafting a malicious request.

## Affected products

- MDJM MDJM Event Management through 1.7.8.7
- MDJM Mobile Events Manager through 1.7.8.7

## Timeline

- 2026-11-02: disclosed
- 2026-11-06: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/](https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/)

## Related threats

- [MDJM Event Management stored XSS in role creation](https://junglewise.ai/threats/cve-2026-88801-the-mdjm-event-management-and-mobile-events-manager-wordpress)
- [MDJM Event Management and Mobile Events Manager account takeover via IDOR](https://junglewise.ai/threats/cve-2026-88799-the-mdjm-event-management-and-mobile-events-manager-wordpress)
- [MDJM Event Management privilege escalation in WordPress plugin](https://junglewise.ai/threats/cve-2026-15017-mdjm-event-management-privilege-escalation-in-wordpress-plugin)
- [MDJM Event Management arbitrary file upload in mdjm_send_comm_email](https://junglewise.ai/threats/cve-2026-7537-mdjm-event-management-arbitrary-file-upload-in-mdjm-send-comm)