Vulnerability-Lookup

GHSA-WWX3-3QMM-8RCH

Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-23 12:32

Details

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init() functions, combined with the absence of server-side allow-list validation on the employee_roles[] and new_role POST parameters before they are passed to mdjm_set_employee_role() and WP_User::set_role(). This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including mdjm_employee and mdjm_employee_edit — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. MDJM_Permissions::init() is registered on the public WordPress init hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-15017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T10:16:50Z",
    "severity": "HIGH"
  },
  "details": "The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities \u2014 including `mdjm_employee` and `mdjm_employee_edit` \u2014 to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.",
  "id": "GHSA-wwx3-3qmm-8rch",
  "modified": "2026-07-23T12:32:21Z",
  "published": "2026-07-23T12:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15017"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/roles/class-mdjm-permissions.php#L24"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/roles/class-mdjm-permissions.php#L36"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/users/class-mdjm-employee-manager.php#L406"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/employee-functions.php#L789"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/mobile-dj-manager.php#L107"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a691f92-9eff-4777-8198-b7cc5d9e73c0?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-15017 (GCVE-0-2026-15017)

Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-23 14:00

Title

MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers

Summary

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/mobile…
https://plugins.trac.wordpress.org/browser/mobile…
https://plugins.trac.wordpress.org/browser/mobile…
https://plugins.trac.wordpress.org/browser/mobile…
https://plugins.trac.wordpress.org/browser/mobile…

Impacted products

1 product

Vendor	Product	Version
mdjm	MDJM Event Management	Affected: 0 , ≤ 1.7.8.4 (semver)

Credits

moonge

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:59:27.807390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:00:37.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MDJM Event Management",
          "vendor": "mdjm",
          "versions": [
            {
              "lessThanOrEqual": "1.7.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "moonge"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities \u2014 including `mdjm_employee` and `mdjm_employee_edit` \u2014 to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T09:33:56.808Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a691f92-9eff-4777-8198-b7cc5d9e73c0?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/employee-functions.php#L789"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/users/class-mdjm-employee-manager.php#L406"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/roles/class-mdjm-permissions.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/includes/admin/roles/class-mdjm-permissions.php#L36"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.8.4/mobile-dj-manager.php#L107"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-07T23:33:31.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-22T20:47:53.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MDJM Event Management \u003c= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via \u0027set-permissions\u0027 and \u0027change_role\u0027 Handlers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15017",
    "datePublished": "2026-07-23T09:33:56.808Z",
    "dateReserved": "2026-07-07T23:18:19.998Z",
    "dateUpdated": "2026-07-23T14:00:37.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WWX3-3QMM-8RCH

CVE-2026-15017 (GCVE-0-2026-15017)

Tags

Sightings

Nomenclature