---
id: CVE-2026-88799
title: >-
  MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+
  Account Takeover via IDOR
summary: >-
  The MDJM Event Management and Mobile Events Manager WordPress plugins through
  1.7.8.7 do not check ownership or capability on the identifier supplied to
  their client profile update, allowing any authenticated user, such as a
  subscriber, …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
product: MDJM Event Management
affected:
  - mdjm_event_management <= 1.7.8.7
  - mobile_events_manager <= 1.7.8.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:40:55.490687Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:50:25.910Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88799'
references:
  - url: 'https://wpscan.com/vulnerability/d808129b-e0cc-400a-9c30-33a9d0e357e9/'
tags:
  - cve.org
ingestedAt: '2026-11-06T07:47:15.876Z'
epss: 0.00286
epssPercentile: 0.21229
---

## Overview

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

## Affected

- `mdjm_event_management <= 1.7.8.7`
- `mobile_events_manager <= 1.7.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.