CVE-2026-15017

Name of the Vulnerable Software and Affected Versions MDJM Event Management versions prior to 1.7.8.5

Description This issue allows unauthenticated attackers to grant arbitrary capabilities, such as mdjm employee and mdjm employee edit, to any registered WordPress role. This is possible because the MDJM Permissions::init() function is registered on the public WordPress init hook without authentication, making the role-manipulation endpoint accessible without login. The flaw stems from missing capability checks and nonce verification (a unique token used to prevent cross-site request forgery) in the MDJM Permissions::set permissions() and MDJM Employee Manager::init() functions. Additionally, there is a lack of server-side allow-list validation for the employee roles[] and new role POST parameters before they are processed by mdjm set employee role() and WP User::set role(). Consequently, an attacker can use a subscriber-level account to escalate privileges to Administrator.

Recommendations Update to a version newer than 1.7.8.4.