EUVD-2026-77088
GHSA-4798-x83m-xr8f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
PR:N confirmed by description; A:L added because mass permanent deletion of pages and media can materially disrupt site availability beyond mere integrity loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
AnalysisAI
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Either the MDJM Event Management plugin (version below 1.7.8.5) or the Mobile Events Manager plugin (version 1.4.8.3 or earlier) must be installed and activated on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures the zero-barrier network exploitability - no authentication, no user interaction, and no complexity required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | For MDJM Event Management, upgrade to version 1.7.8.5 or later, which introduces the missing capability check, nonce validation, and post-type verification in the playlist deletion handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress infrastructure to identify sites using MDJM Event Management plugin prior to 1.7.8.5 or Mobile Events Manager plugin at version 1.4.8.3 or earlier; immediately restrict public access to high-value installations pending patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mdjm Event Management
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today