Description

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T21:17:02.323Z",
  "pubdate": "2026-09-13T21:17:02.323Z",
  "executiveSummary": "The MDJM Event Management and Mobile Events Manager WordPress plugins are susceptible to a critical Broken Access Control vulnerability. This flaw allows unauthenticated attackers to permanently delete arbitrary content from a WordPress installation, including posts, pages, and media attachments.\nThe vulnerability originates from a lack of authorization checks and cryptographic verification within the playlist entry removal functionality. Specifically, the affected code fails to validate the current user's capabilities, missing a nonce for Cross-Site Request Forgery (CSRF) protection, and does not restrict the types of records eligible for deletion.\nThe risk implication is high, as an attacker can perform a destructive operation without any prior authentication or administrative privileges. By crafting a specific HTTP request, an adversary can bypass the WordPress trash mechanism, leading to irreversible data loss and potential site compromise.\nThe vulnerability affects MDJM Event Management versions prior to 1.7.8.5 and Mobile Events Manager versions through 1.4.8.3. There are no prerequisites for authentication, making this an externally exploitable flaw that poses a significant threat to the integrity and availability of the affected WordPress environment.",
  "technicalDetails": "The vulnerability resides in the playlist entry removal mechanism of both the MDJM Event Management and Mobile Events Manager plugins. The root cause is the failure to implement appropriate security controls during the processing of deletion requests. Specifically, the endpoint responsible for handling playlist modifications fails to perform an `current_user_can()` capability check, which is necessary to ensure that the requester possesses sufficient privileges to delete content.\nFurthermore, the implementation lacks a nonce verification step. WordPress nonces are critical for verifying that a request originated from the expected application context, protecting against unauthorized or forged actions. The absence of this token allows attackers to trigger the deletion process via CSRF or direct unauthorized requests to the vulnerable handler.\nThe attack flow follows a predictable sequence: First, the attacker identifies the public-facing or administrative endpoint associated with the playlist entry removal feature. Second, the attacker crafts an HTTP request targeting the object ID of the post, page, or media attachment they intend to delete. Because the plugin does not validate the record type, the attacker can supply the ID of any arbitrary post within the WordPress database.\nWhen the request is received by the server, the vulnerable function processes the deletion command without checking the user session or the integrity of the request. Critically, the implementation executes a permanent deletion rather than sending the targeted entity to the WordPress Trash. This bypasses the safety mechanism provided by the CMS, rendering the loss of data immediate and irreversible, unless a valid database backup exists.\nThe impact is a complete loss of integrity and availability for the affected content. An attacker can systematically enumerate and delete all posts, pages, or media files, effectively taking the site offline or causing severe defacement. Because the vulnerability is accessible to unauthenticated remote attackers, it provides a low-complexity vector for significant sabotage without leaving extensive application-level authentication logs."
}