External risk intelligence

WordPress MDJM Event Management Role Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-88800

The vulnerability exists in WordPress plugins which are commonly deployed as part of public-facing web applications. Because these plugins operate on every page load and are accessible to unauthenticated users via standard web traffic, the attack surface is exposed to the public internet by default in typical WordPress deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain WordPress plugins, specifically the MDJM Event Management and Mobile Events Manager plugins. This issue allows unauthenticated attackers to remove any user roles, including administrator roles, potentially causing a complete loss of user capabilities across the affected system.

Attackers can delete any user roles.
This affects core WordPress site functionality.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a crafted request to a vulnerable WordPress site. Because the affected code runs on every page load without proper checks, the attacker can trick the system into deleting any user role, including administrator roles. This would remove all user permissions, effectively locking everyone out of the site.

No special access needed.
Deletes any role on page load.
Removes all user capabilities.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete any WordPress role, including administrator roles, on every page load. This permanent removal of user capabilities could disrupt service for all users.

WordPress roles and user capabilities.
Unauthenticated role deletion on page load.
Permanent loss of user access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MDJM Event Management and Mobile Events Manager WordPress plugins require immediate attention due to a critical vulnerability that allows unauthenticated attackers to delete any WordPress role, including administrator, permanently stripping users of their capabilities. This impacts systems running these plugins, potentially affecting application owners, infrastructure teams, and security teams responsible for WordPress deployments. The first step is to identify all instances of these plugins, confirm their exposure and criticality, and then plan remediation based on risk.

Identify affected WordPress instances.
Verify plugin reachability and criticality.
Plan role deletion protection and upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MDJM Event Management plugin?

This software consists of the MDJM Event Management and Mobile Events Manager plugins for WordPress. These tools are designed to help site administrators manage, organize, and display event schedules and related logistics directly from the WordPress dashboard.

What is the security weakness in CVE-2026-88800?

The vulnerability is categorized as an improper authorization flaw. The plugin code lacks necessary capability checks and security tokens, meaning it fails to verify user permissions before executing sensitive actions.

How does the trigger path impact WordPress roles?

The plugin processes role deletion requests during every page load. Because the code misinterprets request parameters, it neglects to protect roles that have active users assigned, allowing an unauthenticated party to trigger the deletion of any role, including administrators.

Is this vulnerability relevant to my web application?

Yes. According to the Halo Surface Signal, this vulnerability is likely to affect your system because it exists in plugins commonly found on public-facing sites. Since the flaw is reachable via standard web traffic on every page load, the attack surface is exposed to the internet by default.

How should administrators respond to this risk?

Security and infrastructure teams should immediately inventory all WordPress instances to identify where these plugins are active. Once identified, assess the risk to your environment and prioritize updating or removing the plugins to prevent unauthorized role deletion.

References

wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.