WordPress Event Management Plugin Privilege Escalation Flaw

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The MDJM Event Management plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 1.7.8.4. Attackers can exploit missing capability checks, absent nonce verification, and lack of server-side validation on role assignment parameters to arbitrarily escalate their account privileges to administrator level. This vulnerability is particularly dangerous because it requires minimal prerequisites—an attacker needs only basic user access to the WordPress installation to elevate themselves to full administrative control, potentially compromising entire event management systems and their underlying WordPress instances. Organizations running WordPress sites with this plugin installed, especially those managing events or bookings, face immediate risk of complete account takeover and system compromise.

Casky's 224 matched skills detect this vulnerability pattern by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation) through multiple detection angles. Practitioners using Casky would identify suspicious patterns including: unauthorized role modification attempts in WordPress logs, POST requests to vulnerable functions without proper nonce tokens, direct manipulation of user capability metadata, and unexpected escalations from subscriber or contributor roles to administrator. The platform's Claude-powered analysis with extended reasoning would highlight the absence of capability checks as a foundational control failure, flag the specific parameter manipulation in `employee_roles[]` and `new_role` POST variables, and correlate these indicators with known privilege escalation attack chains. Security teams would see findings mapping to improper access control patterns, insufficient input validation, and missing CSRF protections—enabling them to prioritize patch deployment and audit existing user role changes for signs of exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15017.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15017

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15017. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn