Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-06T08:17:38.283Z",
  "pubdate": "2026-11-06T08:17:38.283Z",
  "executiveSummary": "The MDJM Event Management and Mobile Events Manager WordPress plugins through version 1.7.8.7 are susceptible to an unauthenticated privilege escalation and denial-of-service vulnerability.\nThe flaw stems from a critical lack of authorization and CSRF protection within the role deletion mechanism, which triggers on every page load.\nAn unauthenticated attacker can supply malicious requests to delete arbitrary WordPress roles, including the 'administrator' role.\nSuccessful exploitation results in the permanent stripping of administrative capabilities from users, effectively locking out site administrators and disrupting the integrity of the WordPress installation.\nDue to the absence of capability checks and nonce validation, the vulnerability is trivial to exploit via a simple HTTP request.\nThis vulnerability poses a critical risk to site availability and security posture, as it allows unauthorized parties to compromise the entire user management system of the WordPress instance.",
  "technicalDetails": "The vulnerability resides in the core handling of role deletion requests within the MDJM Event Management and Mobile Events Manager plugins. The implementation fails to enforce any form of access control, meaning the code responsible for deleting a role does not verify if the requesting user possesses 'manage_options' or any administrative capabilities.\nFurthermore, the function responsible for processing role deletions lacks nonce verification, rendering it completely exposed to Cross-Site Request Forgery (CSRF) and direct unauthenticated manipulation. The logic is configured to execute on every page load, meaning that once the malicious payload is crafted, it will trigger immediately upon the execution of the plugin's initialization logic.\nThe root cause is a significant discrepancy between the validation guard and the execution logic. The code implements a check intended to prevent the deletion of roles that currently have assigned users; however, this guard evaluates a different parameter than the one used to determine which specific role should be deleted. This mismatch allows an attacker to bypass the protection logic while still targeting sensitive roles.\nAn attack flow typically involves an attacker sending an HTTP request containing the specific parameters targeted by the plugin to trigger the deletion process. Because there is no authentication requirement and no nonce verification, the attacker does not need to be logged in to the WordPress site. By specifying the 'administrator' role in the delete request, the plugin logic processes the removal. Because the guard logic is misaligned, the system fails to recognize that the administrator role is currently in use, allowing the deletion to proceed.\nThe post-exploitation impact is severe. Once a role is deleted in WordPress, users assigned to that role lose all capabilities associated with that role. If the 'administrator' role is deleted, all administrators are effectively demoted to subscribers or lose their access privileges entirely. Because this occurs within the WordPress database level, the impact is persistent and requires manual database restoration to remediate, as the plugins provide no mechanism to recover the deleted roles."
}