home / blog
2026-11-06 · critical
CVE-2026-88800: Unauthenticated WordPress Role Deletion Vulnerability
CVSS 9.1: unauthenticated deletion of WordPress roles including administrator. Permanent capability loss.
CVE-2026-88800 affects WordPress plugins MDJM Event Management and Mobile Events Manager through version 1.7.8.7. A logic flaw allows any unauthenticated user to delete any WordPress role. The protection mechanism checks one request parameter to verify if a role has assigned users, but the deletion code reads a different parameter, enabling bypass. The result is permanent removal of critical roles such as administrator, denying all users access and capabilities.
The vulnerability has a CVSS score of 9.1 with declared critical severity. It was published on 2026-11-06. Two posts on X within the last 24 hours reported the vulnerability, generating engagement and indicating awareness in the security community. No public exploit has been identified at publication time. Vendors have not yet released a patch according to available signals.
WordPress administrators must immediately disable MDJM Event Management and Mobile Events Manager plugins. Audit the WordPress database to verify whether roles have been modified or deleted. Review audit logs for any role access or modification attempts in recent days. Monitor official plugin channels and the NVD page for patch announcements. Once available, test patches in a non-production environment before deploying to production.
At a glance
- What
- MDJM Event Management and Mobile Events Manager plugins (versions ≤1.7.8.7) process role deletion requests on every page load without capability checks and without nonce validation. A logic flaw in the protection mechanism—which reads one request parameter to verify role assignment but another to execute deletion—allows unauthenticated attackers to remove any role, including administrator.
- Severity
- CVSS 9.1 (critical). Impact spans confidentiality (role exposure), integrity (role modification), and availability (loss of administrative access).
- Affected versions
- MDJM Event Management and Mobile Events Manager, through version 1.7.8.7.
- Fix
- Not reported in available sources as of publication date (2026-11-06).
- Status
- CVE published 2026-11-06. X signals confirm public awareness of the vulnerability. No public exploit identified at publication time.
- Action
- Immediately disable MDJM Event Management and Mobile Events Manager plugins if installed. Audit WordPress database for unauthorized role modifications. Monitor for anomalous access patterns. Await official patch before re-enabling plugins.
Sources: NVD, CVE-2026-88800