The MDJM Event Management and Mobile Events Manager WordPress plugins contain a flaw that causes any role deletion request to be processed on every page load. The plugin performs the deletion with no capability check and no nonce verification, and the guard that was meant to protect roles with assigned users reads a different part of the request. As a result, unauthenticated attackers can send a request that deletes any WordPress role, including the administrator role, thereby permanently stripping all users of their capabilities.

WordPress installations running the MDJM Event Management or Mobile Events Manager plugins with versions up to and including 1.7.8.7 are affected. The vulnerability exists in the plugin code that handles role deletion, regardless of the host theme or other plugins. The vendor is unknown and no exact product version list is provided beyond the maximum vulnerable version.

A CVSS score of 9.1 places this issue in the high severity range, indicating that exploitation can lead to complete loss of administrative control. The EPSS score is not available, but the vulnerability can be triggered by an unauthenticated HTTP request to any page that loads the plugin, making the attack vector straightforward and likely available in the wild. The attack supplies a role identifier to delete without authentication or nonce validation, removing roles that still have users assigned. Because the vulnerability is independent of user input sanitization, it can be exploited by any attacker who can reach the site, potentially causing irreversible damage to site ownership and content management.