MDJM Event Managementの脆弱性、管理者ロール削除
Summary
WordPressプラグインのMDJM Event ManagementとMobile Events Manager（1.7.8.7以前）に、管理者を含むロールを削除され、全ユーザーの権限が失われる脆弱性があります。使っているサイトは版を確認し、修正版の有無をベンダーの告知で調べ、出ていなければ無効化してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressプラグインのMDJM Event ManagementとMobile Events Manager（1.7.8.7以前）に、管理者を含むロールを削除され、全ユーザーの権限が失われる脆弱性があります。使っているサイトは版を確認し、修正版の有無をベンダーの告知で調べ、出ていなければ無効化してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://wordpress.org/plugins | MDJM Event Management |
≤ 1.7.8.7 |
— |
| https://wordpress.org/plugins | Mobile Events Manager |
≤ 1.7.8.7 |
— |
Original description The description as published by the source.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com