CVE-2026-88802
MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
HIGH 7.5EPSS 0.4%
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
- Affected
- MDJM Event Management · Mobile Events Manager
- CVSS v3.1 WPSCAN
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- 0.40% chance of exploitation in the next 30 days, 33rd percentile
- Published
- 2026-09-13
- Updated
- 2026-09-14