WordPress Role Deletion Without Authentication or Verification

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-88800 is a critical authentication bypass vulnerability affecting MDJM Event Management and Mobile Events Manager WordPress plugins through version 1.7.8.7. The vulnerability allows unauthenticated attackers to delete any WordPress role, including administrator accounts, by exploiting missing capability checks and nonce validation on role deletion requests. Because the vulnerability processes deletion requests on every page load and contains a logic flaw where the security guard reads a different request parameter than the deletion mechanism uses, attackers can permanently strip all users of their assigned capabilities. This impacts any WordPress installation running these vulnerable plugins, affecting site owners, administrators, and all end-users who depend on those sites.

Casky's 283 matching skills use Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unauthenticated requests targeting role management endpoints, repeated role deletion attempts lacking proper nonce tokens, parameter mismatches in request validation logic, and capability checks that execute against incorrect request variables. The platform's skill mapping would surface evidence of privilege escalation through role removal, detection of requests manipulating user permissions without authentication, and identification of authorization bypass techniques. Practitioners would see findings highlighting the absence of capability verification before destructive actions, the nonce validation flaw, and evidence of successful role manipulation affecting administrator accounts—enabling rapid remediation before attackers strip administrative access across an organization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88800.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-88800

Casky has 283 skills that investigate the attack patterns behind CVE-2026-88800. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn