Vulnerability · Published Sep 13, 2026 · Assigned by WPScan

CVE-2026-88802MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

High 7.5

In plain English

A high-severity missing authorization in MDJM Event Management from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 65.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

Affected products (as reported)

Vendor	Product	Versions
Unknown	MDJM Event Management	0 – before 1.7.8.5
Unknown	Mobile Events Manager	0 – through 1.4.8.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/cac1846c-bbf4-4ad2-8dfb-d7025034a9a7/ exploit, vdb-entry, technical-description