CVE-2026-88802
Received Received - Intake

Unauthenticated Post Deletion in MDJM Event Management Plugin

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: WPScan

Description
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-88802

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mdjm event_management to 1.7.8.5 (exc)
mobile_events_manager mobile_events_manager to 1.4.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). It allows unauthenticated attackers to delete any posts, pages, or media files by exploiting missing capability, nonce, or record type checks in the playlist entry removal function.

Impact Analysis

An attacker could permanently delete important website content like posts, pages, or media files without authentication. This could disrupt website functionality, remove critical data, and cause significant downtime or loss of information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized deletion of personal or sensitive data. Loss of such data may violate regulatory requirements for data integrity and availability.

Mitigation Strategies

Update the MDJM Event Management plugin to version 1.7.8.5 or later and the Mobile Events Manager plugin to a patched version to address the vulnerability. If immediate updates are not possible, consider disabling the plugins temporarily until updates are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart