The MDJM Event Management plugin contains missing capability checks and nonce validation in its permission and employee management handlers (an example of CWE‑269: Improper Privilege Management). As a result, unauthenticated attackers can post the employee_roles and new_role parameters to the backend functions mdjm_set_employee_role() and WP_User::set_role() without server‑side validation or confirmation. An attacker can therefore grant arbitrary MDJM capabilities, such as mdjm_employee and mdjm_employee_edit, to any existing WordPress role. Because these capabilities can be used to elevate a subscriber account to Administrator, the flaw enables a direct privilege escalation path on the site.

WordPress sites running the MDJM Event Management plugin, all releases up to and including version 1.7.8.4. The vendor is MDJM, and the product is MDJM Event Management.

This vulnerability is a case of CWE‑269: Improper Privilege Management. The flaw receives a CVSS score of 8.8, indicating a high impact vulnerability. Although the EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, the exploitation requires no authentication and is reachable via the public WordPress init hook. An attacker can exploit it by sending crafted POST requests to the exposed set‑permissions or change_role endpoints, thereby creating a new Administrator user from a low‑privilege role. Due to the lack of checks, the attack is straightforward for a remote attacker targeting a compromised site.