MDJM and Mobile Events Manager plugins skip ownership checks, allowing account takeover
WordPress event plugins let any member take over admin accounts.
Summary
Any logged-in user, such as a subscriber, can change the password and email of other accounts, including administrators, in the MDJM Event Management and Mobile Events Manager WordPress plugins. Versions through 1.7.8.7 are affected.
Affected when
- WordPress site with the MDJM Event Management or Mobile Events Manager plugin installed
- At least one account able to log in (such as a subscriber)
What to do
No fixed version is known yet. If you run version 1.7.8.7 or older, check that your version is newer than that and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen