The vulnerability in the MDJM Event Management and Mobile Events Manager WordPress plugins allows an authenticated user who does not own a profile to modify the password and email address of any other user account. The lack of ownership or capability checks creates an IDOR flaw that can be exploited to hijack any account, including those with administrator privileges, thereby fully compromising the site’s user management and potentially the entire application.

Vendors listed as Unknown:MDJM Event Management and Unknown:Mobile Events Manager. The plugins are affected in any version up to and including 1.7.8.7. No specific version numbers beyond this are specified in the available data.

The flaw carries a CVSS score of 8.8, indicating high severity, but no EPSS score is available. It is not currently listed in the CISA KEV. An attacker would need to be authenticated as any user such as a subscriber, then exploit the exposed API endpoint that accepts a user identifier to perform the update. Because the plugin does not verify that the requester owns the target profile or has appropriate capabilities, the attack path is straightforward and does not require additional privileges.