CVE-2026-15017 is a privilege escalation vulnerability in the MDJM Event Management plugin for WordPress affecting all versions up to and including 1.7.8.4. The issue arises from missing capability checks and nonce verification in the MDJM_Permissions::set_permissions() and MDJM_Employee_Manager::init() functions. Additionally, there is no server-side allow-list validation on the employee_roles[] and new_role POST parameters before they are passed to mdjm_set_employee_role() and WP_User::set_role(). Because MDJM_Permissions::init() is registered on the public WordPress init hook without authentication, an unauthenticated attacker can exploit this to grant arbitrary MDJM capabilities to any registered WordPress role, including elevating a subscriber-level account to administrator privileges.

Successful exploitation allows unauthenticated attackers to escalate privileges from low-level WordPress roles (such as subscriber) to administrator by assigning arbitrary MDJM capabilities and roles. This results in full control over the affected WordPress site, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor and apply official patches once released.