Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T08:17:38.130Z",
  "pubdate": "2026-11-06T08:17:38.130Z",
  "executiveSummary": "The MDJM Event Management and Mobile Events Manager WordPress plugins (up to version 1.7.8.7) suffer from a critical Broken Access Control vulnerability.\nThe flaw stems from a lack of server-side ownership and capability validation during the client profile update process.\nThis allows any authenticated user, including those with minimal privileges such as 'subscriber', to arbitrarily modify the account details of other users, including administrators.\nBy manipulating the identifier associated with the profile update request, an attacker can overwrite the email address and password of a target account.\nSuccessful exploitation results in a full account takeover, granting the attacker the permissions associated with the compromised account.\nGiven the severity, this vulnerability presents a high risk to system integrity and data confidentiality, as it facilitates unauthorized escalation of privileges and potential site-wide compromise.\nExploitation requires active authentication on the affected WordPress instance but does not require administrative privileges.",
  "technicalDetails": "The vulnerability resides within the user profile management functionality of both MDJM Event Management and Mobile Events Manager plugins, specifically in the component responsible for processing profile updates for client profiles.\nThe root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) arising from insufficient authorization checks. The application fails to perform a validation check to verify that the user initiating the update request possesses the necessary permissions to modify the user record identified by the submitted parameter.\nIn a secure implementation, the server should verify the current user's session against the target user ID to ensure the user is only modifying their own data, or possesses sufficient administrative capabilities to modify others. In this instance, the plugin blindly trusts the identifier provided by the client-side request.\nThe attack flow proceeds as follows: 1. An authenticated attacker identifies the target user's identifier (typically a user ID). 2. The attacker crafts a malicious request targeting the plugin's profile update function. 3. The attacker injects the target's identifier into the request parameters. 4. The server-side code processes the request without validating whether the current session's user ID matches the target identifier. 5. The application updates the record in the WordPress 'wp_users' table (or associated metadata), setting the attacker-defined password and email address for the target account.\nThis allows an attacker to effectively hijack any account on the system. Once the password is changed, the attacker can log into the target account, bypassing all previous authentication controls. If an administrator account is targeted, the attacker gains full control over the WordPress installation, enabling the execution of administrative actions such as installing malicious plugins, modifying site content, or exfiltrating sensitive data.\nThis vulnerability is present in versions 1.7.8.7 and earlier. It is exposed via the standard network interfaces of the WordPress site and requires no specialized network positioning beyond the ability to authenticate as a user on the platform. The lack of authorization checks renders the entire user base vulnerable to account takeover."
}