CVE-2026-88802: MDJM Event Management Auth Bypass Flaw

CVE-2026-88802 Overview

CVE-2026-88802 affects the MDJM Event Management WordPress plugin before version 1.7.8.5 and the Mobile Events Manager WordPress plugin through version 1.4.8.3. The plugins expose a playlist entry removal endpoint that fails to verify capability checks, nonces, or the type of record being deleted. Unauthenticated attackers can send crafted requests to permanently delete arbitrary WordPress posts, pages, and media attachments, bypassing the trash. The flaw maps to [CWE-862] Missing Authorization and results in loss of integrity for site content.

Critical Impact

Unauthenticated remote attackers can permanently destroy any post, page, or media attachment on affected WordPress sites, with no user interaction required.

Affected Products

• MDJM Event Management WordPress plugin versions before 1.7.8.5
• Mobile Events Manager WordPress plugin versions through 1.4.8.3
• WordPress sites using either plugin in default configuration

Discovery Timeline

• 2026-09-13 - CVE-2026-88802 published to the National Vulnerability Database
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-88802

Vulnerability Analysis

The vulnerability resides in the playlist entry removal handler exposed by both plugins. The handler accepts a post identifier from the request and calls WordPress deletion functionality without validating who is making the request or what type of object is being deleted. Because the code bypasses the trash and performs a permanent deletion, destroyed content cannot be recovered through the WordPress admin interface.

The handler suffers from three compounding failures. It does not verify the caller holds a capability such as delete_posts or delete_others_posts. It does not validate a nonce, so requests cannot be attributed to a legitimate session. It does not restrict the deletion target to playlist entry post types, so any post ID resolves to a deletion candidate.

Root Cause

The root cause is Missing Authorization [CWE-862]. The AJAX or admin-post endpoint responsible for removing a playlist entry executes deletion logic before performing access control. WordPress plugins are expected to combine current_user_can() capability checks with check_ajax_referer() nonce validation, and to constrain the target post_type before invoking wp_delete_post( $id, true ). All three controls are absent on the vulnerable code path.

Attack Vector

An unauthenticated attacker crafts an HTTP request to the vulnerable endpoint, supplying the numeric ID of any post, page, or attachment on the target site. The server processes the request without authenticating the caller and forces a permanent deletion. Attackers can enumerate low integer IDs to destroy site content sequentially, remove specific pages such as /checkout or /login, or erase media libraries. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-88802

Indicators of Compromise

• Unauthenticated POST requests to plugin AJAX endpoints referencing mdjm or mem playlist removal actions in web server access logs
• Sudden disappearance of posts, pages, or media attachments without corresponding entries in the WordPress trash
• Bursts of requests iterating sequential post_id or entry_id parameter values from a single source IP
• Missing rows in the wp_posts table that correspond to previously indexed URLs returning HTTP 404

Detection Strategies

• Monitor WordPress access logs for requests to admin-ajax.php containing plugin-specific action parameters from unauthenticated sessions
• Compare scheduled database snapshots of wp_posts to identify unexplained deletions of post, page, or attachment types
• Alert on HTTP 404 spikes for URLs previously returning HTTP 200, which can indicate mass content deletion

Monitoring Recommendations

• Enable WordPress audit logging plugins that record content deletion events with source IP and user context
• Forward web server and application logs to a centralized SIEM for correlation and anomaly detection
• Track file-integrity and database-integrity baselines for the wp-content/uploads directory and the wp_posts table

How to Mitigate CVE-2026-88802

Immediate Actions Required

• Update the MDJM Event Management plugin to version 1.7.8.5 or later on all WordPress installations
• Deactivate and remove the Mobile Events Manager plugin, which remains vulnerable through 1.4.8.3 with no fixed version identified in the advisory
• Take a full database and wp-content backup before applying changes to preserve forensic evidence and enable recovery
• Review recent backups and restore any content that has already been deleted by exploitation attempts

Patch Information

Upgrade MDJM Event Management to version 1.7.8.5, which introduces capability and nonce checks on the playlist entry removal handler. No fixed release is referenced for Mobile Events Manager in the current advisory; administrators should remove the plugin until the vendor publishes an update. Refer to the WPScan Vulnerability Report for tracking upstream fixes.

Workarounds

• Block requests to the vulnerable AJAX action at a web application firewall or reverse proxy until the plugin is patched or removed
• Restrict access to /wp-admin/admin-ajax.php for unauthenticated users where feasible using WAF rules that require a valid session cookie for deletion actions
• Enforce least-privilege file permissions and enable off-site, versioned backups to reduce recovery time if arbitrary deletion occurs

# Example WAF rule (ModSecurity) to block unauthenticated playlist removal requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026088802,\
  msg:'Block CVE-2026-88802 MDJM/MEM playlist removal'"
  SecRule ARGS:action "@rx ^(mdjm|mem)_.*remove.*playlist" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"