Threats tagged 'ghsa-whrj-2wq8-j622'

The MDJM Event Management and Mobile Events Manager WordPress plugins up to version 1.7.8.7 contain a critical vulnerability that allows unauthenticated attackers to delete any WordPress role, including administrator roles. This occurs because the plugins act on role deletion requests on every page load without verifying user capabilities or using a nonce for protection. Additionally, the protection mechanism intended to prevent deletion of roles with assigned users is flawed due to inconsistent request parsing. Exploitation results in permanent removal of roles and stripping of all users' capabilities.