CVE-2026-88802
⚠️ highSummary
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
CVSS Score
7.5
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-09-13
First Seen: 2026-09-16
📊 Relative Risk Intelligence
This CVE is Moderate Risk - more severe than 67.8% of all 358,566 vulnerabilities in our database.
#115,475
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Enrico Marcolini (Dottor Marc)
Claudio Marchesini (Dottor Marc)
WPScan (coordinator)
SSVC data provided by
CISA
Last Modified
2026-09-14
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE IDs (Weakness Types)