CVE-2026-88802

HighCVSS 7.5/10Last modified Sep 14, 2026

Description

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	MDJM Event Management	< 1.7.8.5
Unknown	Mobile Events Manager	<= 1.4.8.3

References

https://wpscan.com/vulnerability/cac1846c-bbf4-4ad2-8dfb-d7025034a9a7/

Timeline

Published: Sep 13, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-888049.6An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Ran CVE-2026-888058.1Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. CVE-2026-888067.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.CVE-2026-888078.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X cl CVE-2026-888088.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluste CVE-2026-888097.6A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests CVE-2026-88817.5Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 has CVE-2026-888107.2A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRo CVE-2026-888119.1Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This aff CVE-2026-888127.8A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a c CVE-2026-888135.3The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount act CVE-2026-888143.7The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed