CVE-2026-15017: WordPress MDJM Plugin Privilege Escalation

CVE-2026-15017 Overview

CVE-2026-15017 is a privilege escalation vulnerability in the MDJM Event Management plugin for WordPress. The flaw affects all versions up to and including 1.7.8.4. Unauthenticated attackers can invoke role-manipulation logic because MDJM_Permissions::init() registers on the public WordPress init hook without any authentication gate. Missing capability checks, absent nonce verification, and lack of server-side allow-list validation on the employee_roles[] and new_role POST parameters allow attackers to grant arbitrary MDJM capabilities to any registered role. A subscriber-level account can then escalate to Administrator.

Critical Impact
Unauthenticated attackers can reassign MDJM capabilities to low-privilege WordPress roles and pivot a subscriber account to full Administrator control of the site.

Affected Products

MDJM Event Management plugin for WordPress — all versions up to and including 1.7.8.4
WordPress sites running the mobile-dj-manager plugin with any registered user roles
Subscriber-level or higher WordPress accounts on affected installations

Discovery Timeline

2026-07-23 - CVE-2026-15017 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15017

Vulnerability Analysis

The vulnerability is classified under [CWE-269: Improper Privilege Management]. It resides in two related code paths within the MDJM Event Management plugin: MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init(). Both functions handle role and capability assignments but omit current_user_can() capability checks and wp_verify_nonce() request validation.

The plugin registers MDJM_Permissions::init() on the WordPress public init action hook. This hook fires for every request, including unauthenticated ones. As a result, the role-manipulation endpoint is reachable without any prior login. Attackers can submit crafted POST requests to modify plugin capability mappings and reassign roles.

Root Cause

The root cause is threefold. First, capability checks are missing before privileged operations execute. Second, nonce verification is absent, so cross-site request forgery protection does not apply. Third, no server-side allow-list validates the employee_roles[] and new_role POST parameters before they reach mdjm_set_employee_role() and WP_User::set_role(). Any string can therefore be passed as a target role.

Attack Vector

An attacker sends unauthenticated POST requests to the vulnerable endpoint to grant MDJM capabilities such as mdjm_employee and mdjm_employee_edit to the default WordPress subscriber role. The attacker then authenticates as a subscriber-level account and calls WP_User::set_role() through the same unvalidated logic. This assigns the administrator role, granting full site control.

Refer to the Wordfence Vulnerability Report and the plugin source in the WordPress Mobile DJ Manager Code for the specific vulnerable functions.

Detection Methods for CVE-2026-15017

Indicators of Compromise

Unexpected changes to WordPress role capabilities, particularly the subscriber role gaining mdjm_employee or mdjm_employee_edit capabilities.
New administrator accounts or existing low-privilege accounts recently promoted to administrator.
POST requests to WordPress endpoints containing employee_roles[] or new_role parameters from unauthenticated sessions.
Entries in wp_options for wp_user_roles showing modified capability arrays outside of normal administrative activity.

Detection Strategies

Audit the wp_user_roles option in the WordPress database against a known-good baseline to identify unauthorized capability additions.
Review web server access logs for unauthenticated POST requests targeting wp-admin or admin-ajax.php with MDJM role-related parameters.
Monitor the WordPress users table for role changes correlated with recent plugin request activity.

Monitoring Recommendations

Enable file integrity monitoring on the mobile-dj-manager plugin directory and WordPress core role files.
Alert on any HTTP request containing employee_roles[] or new_role parameters until the plugin is patched or removed.
Track privilege escalation events by logging every call to WP_User::set_role() through a WordPress security plugin or application-layer logging.

How to Mitigate CVE-2026-15017

Immediate Actions Required

Deactivate and remove the MDJM Event Management plugin on all WordPress sites running version 1.7.8.4 or earlier until a fixed release is available.
Audit all WordPress user accounts and revoke any unexpected administrator role assignments.
Reset passwords and rotate application credentials for all administrator accounts on affected sites.
Restore the default WordPress role capability set if unauthorized modifications are detected in wp_user_roles.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Site owners should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates on a patched release addressing the missing capability checks, nonce verification, and role allow-list validation.

Workarounds

Block requests containing employee_roles[] or new_role parameters at the web application firewall (WAF) layer until a patch is applied.
Restrict access to wp-admin and admin-ajax.php by IP allow-listing for administrative networks where feasible.
Disable user registration on affected WordPress sites to prevent attackers from obtaining a subscriber account to complete the escalation chain.

bash

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate mobile-dj-manager
wp plugin delete mobile-dj-manager

# Verify no unauthorized administrators exist
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered