Bug 2568045 (CVE-2026-88799) - CVE-2026-88799 mdjm-event-management: mobile-events-manager: MDJM Event Management and Mobile Events Manager: Privilege escalation via missing authorization check in profile updates
Summary: CVE-2026-88799 mdjm-event-management: mobile-events-manager: MDJM Event Manag...
Keywords:
Status: NEW
Alias: CVE-2026-88799
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-06 07:41 UTC by OSIDB Bzimport
Modified: 2026-11-06 07:47 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-06 07:41:30 UTC 
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
Note You need to log in before you can comment on or make changes to this bug.