What’s Vulnerable › Vulnerabilities
CVE-2026-88802: MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-13 · updated 2026-09-14
- Weakness: CWE-862
Description
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
Affected products
- Mobile Events Manager: through 1.4.8.3
- MDJM Event Management: before 1.7.8.5 — fixed in 1.7.8.5
How to fix
Upgrade to a fixed version: MDJM Event Management 1.7.8.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-88802 or the next vulnerability affects your stack