MDJM Event Management EUVD-2026-47901

The MDJM (Mobile DJ Manager) plugin must be installed and active at version 1.7.8.4 or earlier. The core role-tampering endpoint is reachable without login because MDJM_Permissions::init() is registered on the public WordPress 'init' hook with no capability check and no nonce verification, and the employee_roles[] / new_role POST parameters are not validated against a server-side allow-list. The full escalation to Administrator, as described, leverages a subscriber-level account, so open user registration or a pre-existing low-privileged account is the practical enabler for the final pivot. Limiting factors: the plugin must be present and active; achieving Administrator specifically relies on obtaining a registered (subscriber) account; and the description's 'unauthenticated' reachability conflicts with the vendor PR:L rating, so the exact privilege prerequisite for each step should be confirmed with the vendor.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) rates this network-exploitable with low attack complexity and only low privileges, yielding full confidentiality/integrity/availability impact - consistent with a total site takeover. However, the description text conflicts with the PR:L rating: it explicitly states the init-hook endpoint has 'no authentication gate' and is 'reachable without any prior login,' implying unauthenticated (PR:N) reachability, while the full escalation to Administrator is described as leveraging a subscriber-level account. This suggests the role-tampering step may be unauthenticated but the final admin pivot benefits from a cheap self-registered subscriber account - verify the exact auth requirement with Wordfence. No EPSS score, KEV listing, POC, or SSVC decision data was provided; there is no evidence of active exploitation. Net assessment: a genuinely high-priority flaw for any site running this plugin, given trivial complexity and total impact, but real-world urgency is tempered by the plugin's niche footprint and absence of known exploitation.

An attacker sends a crafted POST request to the site that reaches the unauthenticated MDJM role-management endpoint, injecting employee_roles[] and new_role values that grant MDJM employee capabilities to the Subscriber role. The attacker then self-registers (or uses an existing) subscriber account and leverages the newly granted capabilities to escalate to Administrator, taking over the site. No public POC was referenced, but exploitation requires only standard HTTP requests and low attack complexity.