Description

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-07-23T10:16:50.173Z",
  "pubdate": "2026-07-23T10:16:50.173Z",
  "executiveSummary": "The MDJM Event Management plugin for WordPress in all versions up to, and including, 1.7.8.4 suffers from a critical Privilege Escalation vulnerability. The flaw stems from missing capability checks, absent nonce verification, and a lack of server-side allow-list validation within specific permission management functions. These weaknesses allow unauthenticated attackers across the network to manipulate role definitions and assign arbitrary capabilities to registered WordPress user roles. By granting administrative capabilities or leveraging intermediate roles such as subscriber-level accounts, malicious actors can successfully escalate their privileges to Administrator. The vulnerability exposes affected WordPress deployments to complete system compromise, unauthorized administrative access, and full control over the underlying website operations without requiring any prior authentication or interaction.",
  "technicalDetails": "The vulnerability resides in the permission management and employee initialization components of the MDJM Event Management plugin. Specifically, the vulnerable functions include MDJM_Permissions::set_permissions(), MDJM_Employee_Manager::init(), and MDJM_Permissions::init(). The root cause of the flaw is a combination of missing capability checks, the complete absence of cryptographic nonce verification, and a failure to implement server-side allow-list validation on critical input parameters.\nDuring execution, the application processes incoming POST parameters, namely employee_roles[] and new_role, without validating them against a strict allow-list before passing them to sensitive functions such as mdjm_set_employee_role() and WP_User::set_role(). Furthermore, MDJM_Permissions::init() is hooked directly into the public WordPress init hook without implementing any authentication gate or permission checks, rendering the role-manipulation endpoint publicly accessible over the network without requiring any prior login.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts an HTTP POST request targeting the exposed initialization hook. Second, by supplying malicious values in the employee_roles[] or new_role parameters, the attacker bypasses input validation constraints. Third, the lack of nonce verification and capability checks allows the unauthenticated request to successfully execute MDJM_Permissions::set_permissions(), granting arbitrary MDJM capabilities—such as mdjm_employee and mdjm_employee_edit—to any standard registered WordPress role, such as a subscriber. Finally, the attacker authenticates or utilizes a low-privileged subscriber-level account, leverages the newly acquired administrative or elevated capabilities, and completes the privilege escalation chain to achieve full Administrator privileges on the target WordPress installation."
}