MDJM Event Management and Mobile Events Manager allow unauthenticated role deletion
Anyone can delete admin permission settings in this WordPress event plugin!
Summary
The MDJM Event Management and Mobile Events Manager WordPress plugins let an unauthenticated attacker delete any WordPress role, including administrator. Every user in a deleted role permanently loses its capabilities.
What to do
No fix is known yet. Check that the plugin runs a version newer than 1.7.8.7 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen