{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/mdjm-event-management-plugin--1.7.8.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-15017"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MDJM Event Management plugin \u003c= 1.7.8.4","WordPress"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","privilege-escalation","cve","web-application"],"_cs_type":"advisory","_cs_vendors":["MDJM","WordPress"],"content_html":"\u003cp\u003eThe MDJM Event Management plugin for WordPress contains a critical privilege escalation vulnerability, CVE-2026-15017, affecting all versions up to and including 1.7.8.4. This flaw arises from insufficient capability checks and a lack of nonce verification within the \u003ccode\u003eMDJM_Permissions::set_permissions()\u003c/code\u003e and \u003ccode\u003eMDJM_Employee_Manager::init()\u003c/code\u003e functions. Additionally, the plugin fails to implement server-side allow-list validation on the \u003ccode\u003eemployee_roles[]\u003c/code\u003e and \u003ccode\u003enew_role\u003c/code\u003e POST parameters. Attackers can exploit this by manipulating these parameters to assign arbitrary MDJM capabilities, such as \u003ccode\u003emdjm_employee\u003c/code\u003e and \u003ccode\u003emdjm_employee_edit\u003c/code\u003e, to any existing WordPress user role. The \u003ccode\u003eMDJM_Permissions::init()\u003c/code\u003e function, registered on the public WordPress \u003ccode\u003einit\u003c/code\u003e hook, allows this role manipulation endpoint to be accessed without requiring any prior authentication, making it possible for unauthenticated attackers to grant themselves elevated privileges. This vulnerability ultimately enables a low-privilege user, such as a subscriber, to escalate their account to Administrator privileges, granting full control over the affected WordPress site.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends an HTTP POST request to a WordPress endpoint associated with the \u003ccode\u003eMDJM_Permissions::init()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe POST request includes specially crafted parameters, such as \u003ccode\u003eemployee_roles[]\u003c/code\u003e and \u003ccode\u003enew_role\u003c/code\u003e, attempting to assign MDJM-specific capabilities like \u003ccode\u003emdjm_employee\u003c/code\u003e or \u003ccode\u003emdjm_employee_edit\u003c/code\u003e to a target WordPress user role (e.g., 'subscriber').\u003c/li\u003e\n\u003cli\u003eDue to missing capability checks, nonce verification, and server-side validation in the \u003ccode\u003eMDJM_Permissions::set_permissions()\u003c/code\u003e and \u003ccode\u003eMDJM_Employee_Manager::init()\u003c/code\u003e functions, the plugin processes these manipulated parameters via \u003ccode\u003emdjm_set_employee_role()\u003c/code\u003e and \u003ccode\u003eWP_User::set_role()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe target low-privilege account (e.g., a subscriber) is successfully updated with the newly assigned MDJM capabilities, effectively escalating its permissions within the plugin's scope.\u003c/li\u003e\n\u003cli\u003eThe attacker, now operating with an account that possesses these elevated MDJM capabilities, may leverage other vulnerabilities or functionalities within the plugin or WordPress core.\u003c/li\u003e\n\u003cli\u003eThe attacker uses their newly acquired capabilities to further escalate privileges, potentially by creating new administrative users, modifying existing user roles, or installing malicious plugins/themes.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves full Administrator privileges on the WordPress site, gaining complete control over its content, users, and underlying server if further exploitation is chained.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-15017 allows an unauthenticated attacker to gain administrative control over the affected WordPress site. This provides full access to website content, user data, plugin settings, and server-side files if the WordPress installation is further exploited. Attackers can deface the site, inject malicious scripts (e.g., for drive-by downloads or phishing), exfiltrate sensitive information, or use the compromised server as a platform for further attacks. The severity is high due to the lack of authentication required for initial access and the complete compromise of the website's integrity and confidentiality that follows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-15017 immediately by updating the MDJM Event Management plugin to a patched version once released by the vendor.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious HTTP POST requests directed at WordPress admin endpoints that attempt to manipulate \u003ccode\u003eemployee_roles[]\u003c/code\u003e or \u003ccode\u003enew_role\u003c/code\u003e parameters, which could indicate exploitation attempts related to CVE-2026-15017.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T10:21:37Z","date_published":"2026-07-23T10:21:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-mdjm-privesc/","summary":"An unauthenticated privilege escalation vulnerability (CVE-2026-15017) in the MDJM Event Management plugin for WordPress, affecting all versions up to 1.7.8.4, allows attackers to grant arbitrary MDJM capabilities to any registered WordPress role due to missing capability checks and nonce verification, ultimately enabling a low-privilege user to escalate to Administrator.","title":"WordPress MDJM Event Management Plugin Privilege Escalation (CVE-2026-15017)","url":"https://feed.craftedsignal.io/briefs/2026-07-wordpress-mdjm-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - MDJM Event Management Plugin \u003c= 1.7.8.4","version":"https://jsonfeed.org/version/1.1"}