EUVD-2026-47901
GHSA-wwx3-3qmm-8rch
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable with low complexity; the role endpoint is unauthenticated but full admin escalation leverages a subscriber account, so PR:L is retained conservatively, with total C/I/A impact from site takeover.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init() functions, combined with the absence of server-side allow-list validation on the employee_roles[] and new_role POST parameters before they are passed to mdjm_set_employee_role() and WP_User::set_role(). This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities - including mdjm_employee and mdjm_employee_edit - to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. MDJM_Permissions::init() is registered on the public WordPress init hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.
AnalysisAI
Privilege escalation in the MDJM Event Management (Mobile DJ Manager) plugin for WordPress through version 1.7.8.4 lets attackers grant arbitrary MDJM capabilities to any registered role and pivot a low-privileged account up to Administrator. The flaw stems from a role-manipulation endpoint wired to the public WordPress init hook with no authentication gate, no nonce verification, and no allow-list validation of submitted roles. No public exploit identified at time of analysis, but the issue was reported by Wordfence and carries a CVSS of 8.8.
Technical ContextAI
MDJM (Mobile DJ Manager) is a WordPress plugin for event/DJ business management that layers its own custom capabilities (e.g. mdjm_employee, mdjm_employee_edit) on top of the native WordPress role system. The vulnerability is a CWE-269 Improper Privilege Management issue: MDJM_Permissions::init() hooks set_permissions() onto the global WordPress 'init' action, which fires on every request including unauthenticated ones. Because set_permissions() and MDJM_Employee_Manager::init() lack current_user_can() capability checks and check_admin_referer() nonce verification, and because the employee_roles[] and new_role POST parameters are passed straight to mdjm_set_employee_role() and WP_User::set_role() with no server-side allow-list, an attacker controls which capabilities are assigned to which role. Granting MDJM capabilities to the Subscriber role, then using a subscriber account, chains into full administrative control.
RemediationAI
No vendor-released patched version is identified in the provided data - the description states all versions up to and including 1.7.8.4 are affected and cites no fixed release, so monitor the plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2a691f92-9eff-4777-8198-b7cc5d9e73c0) for an update above 1.7.8.4 and upgrade as soon as it ships. Until a fix is available, the most effective compensating control is to deactivate and remove the MDJM Event Management plugin, which fully closes the exposure at the cost of losing DJ/event-management functionality. If the plugin must stay active, use a WAF or web server rule to block unauthenticated POST requests carrying the employee_roles[] or new_role parameters to the site (trade-off: may break legitimate employee-role administration and requires request-body inspection), and restrict/disable open user registration (Settings > General > 'Anyone can register') to remove the cheap subscriber foothold used in the escalation chain. Audit existing WordPress roles for unexpected mdjm_employee/mdjm_employee_edit capabilities and review the administrators list for rogue accounts.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today