WordPress Event Plugins Allow Unauthorized Account Takeover

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-88799 affects the MDJM Event Management and Mobile Events Manager WordPress plugins (versions through 1.7.8.7), exposing a critical authorization bypass vulnerability. The plugins fail to validate ownership or user capabilities when processing client profile updates, allowing any authenticated user—even those with minimal subscriber-level permissions—to modify other users' passwords and email addresses. This creates a direct path to account takeover of administrative accounts, giving attackers complete control over WordPress installations. Any organization running these plugins with multiple user accounts faces severe risk, as the vulnerability requires only basic authentication to exploit, making it accessible to disgruntled insiders or attackers who have obtained low-privilege credentials.

Casky's 283 matching skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky's Claude-powered analysis would identify suspicious patterns including: unauthorized account modification attempts from unexpected user contexts, email address changes on high-privilege accounts without corresponding admin actions, password reset operations originating from low-privilege session contexts, and anomalous permission bypasses in WordPress user management API calls. The platform's extended reasoning capabilities correlate these indicators to reveal the core flaw: missing authorization checks on sensitive account operations. Security teams would surface findings showing which user sessions attempted cross-account modifications, track the progression from low-privilege access to administrative account compromise, and pinpoint the exact plugin functions failing to enforce capability validation—enabling rapid remediation and forensic investigation of prior exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88799.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-88799

Casky has 283 skills that investigate the attack patterns behind CVE-2026-88799. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn