Security Alert Summary
The MDJM Event Management and Mobile Events Manager WordPress plugins contain a vulnerability that allows unauthenticated attackers to permanently delete posts, pages, and media attachments via the plugins’ playlist entry removal functionality. The plugins do not verify capabilities, nonces, or the type of the record before performing the deletion, allowing content to be removed while bypassing the trash.
CVE Details
- CVE ID:
CVE-2026-88802 - Affected components: MDJM Event Management plugin and Mobile Events Manager plugin (playlist entry removal functionality)
- Affected versions:
- MDJM Event Management: versions before 1.7.8.5
- Mobile Events Manager: versions through 1.4.8.3
- Published: September 13, 2026 at 9:17:02 PM UTC
- Last modified: September 14, 2026 at 1:19:00 PM UTC
- CVSS v3.1 base score: 7.5 (HIGH) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Authentication / privileges / user interaction:
- Authentication required: None
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: None
- Integrity: High (unauthenticated deletion of content)
- Availability: None
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The plugins fail to perform necessary authorization and request validation checks in the code path that handles playlist entry removal. Specifically, they do not verify a user capability, check a nonce, or confirm the type of the record before permanently deleting the post identified in the removal request. Because those checks are missing, an unauthenticated attacker can craft requests to the playlist entry removal functionality that result in the permanent deletion of posts, pages, or media attachments and bypass the WordPress trash mechanism.
The description identifies the missing checks (capability, nonce, and record type) as the root cause. The practical effect is direct content removal rather than data disclosure: an attacker can remove arbitrary content by exploiting the playlist entry removal endpoint or handler that performs the deletion without these validations.
How This Could Impact Your Website
Imagine a site owner managing event content, internal staff editing event pages, and a contractor uploading media for event listings. An attacker who discovers the vulnerable playlist entry removal endpoint could issue deletion requests without authenticating. This could result in lost event posts, pages, or media attachments that are removed permanently rather than moved to the trash, disrupting public event listings and internal workflows.
While the CVSS vector indicates no confidentiality impact (this vulnerability does not disclose stored user data), the removal of content and attachments can still have practical consequences: missing pages or media may break navigation, remove evidence of actions, and increase the operational burden on staff. Such disruption can indirectly increase the risk of social engineering or targeted phishing, for example if attackers remove content and then create deceptive replacement pages or communications to solicit credentials or payments.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and accounts with publish/delete capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit logs for unusual deletion events or unexpected requests to playlist-related endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
