{"metadata": {"vulnerability": "CVE-2026-88800", "count": 17, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-10T08:27:53.276Z", "date_only": false, "value": "2026-09-10T08:27:53.276Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T07:30:54.070Z", "date_only": false, "value": "2026-11-06T07:30:54.070Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T07:30:54.070Z", "date_only": false, "value": "2026-11-06T07:30:54.070Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-88800", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T07:40:02.239Z", "date_only": false, "value": "2026-11-06T07:40:02.239406Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117568359743464574", "record": "CVE-2026-88800", "field": "creation_timestamp", "uuid": "7a91b25d-505c-4dfc-80d7-cc2cb73ef2d0", "content": "CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.\nhttps://www.cve.org/CVERecord?id=CVE-2026-88800https://wpscan.com/vulnerability/f39f77ac-1885-4021-a4d2-5a2b7c5260b5/#CVE_2026_88800#bot", "url": "https://infosec.exchange/users/cve/statuses/117568359743464574"}, {"timestamp": "2026-11-06T08:17:38Z", "date_only": false, "value": "2026-11-06T08:17:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WHRJ-2WQ8-J622", "record": "GHSA-WHRJ-2WQ8-J622", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-06T08:17:38.283Z", "date_only": false, "value": "2026-11-06T08:17:38.283", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88800", "record": "FKIE_CVE-2026-88800", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T08:40:02.908Z", "date_only": false, "value": "2026-11-06T08:40:02.908088Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzmybi42km24", "record": "CVE-2026-88800", "field": "creation_timestamp", "uuid": "4191fa7b-07de-410b-bab3-da8f0136634f", "content": "CVE-2026-88800 - mdjm event management\nThe MDJM Event Management and Mobile Events Manager plugins let anyone who visits the site send a request that deletes any user role, even the administrator role. This removes\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzmybi42km24"}, {"timestamp": "2026-11-06T09:31:31Z", "date_only": false, "value": "2026-11-06T09:31:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WHRJ-2WQ8-J622", "record": "GHSA-WHRJ-2WQ8-J622", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T09:31:31Z", "date_only": false, "value": "2026-11-06T09:31:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WHRJ-2WQ8-J622", "record": "GHSA-WHRJ-2WQ8-J622", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T09:43:31.506Z", "date_only": false, "value": "2026-11-06T09:43:31.506205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iutsv4g5x3mmc", "record": "CVE-2026-88800", "field": "creation_timestamp", "uuid": "af8c3476-23e7-4690-8469-9ee765046b74", "content": "CVE-2026-88800 - MDJM Event Management and Mobile Events Manager\nCVE ID : CVE-2026-88800\n \n Published : Nov. 6, 2026, 8:17 a.m. | 52\u00a0minutes ago\n \n Description : The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion reques...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/iutsv4g5x3mmc"}, {"timestamp": "2026-11-06T10:07:31.858Z", "date_only": false, "value": "2026-11-06T10:07:31.858109Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzn55vvagz2j", "record": "CVE-2026-88800", "field": "creation_timestamp", "uuid": "71e071a3-5d14-4d92-ad3f-39409a36c311", "content": "\ud83d\udea8 CVE-2026-88800 \u2014 CVSS 9.1 CRITICAL\n\nThe MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletio...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88800\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzn55vvagz2j"}, {"timestamp": "2026-11-06T11:40:49.447Z", "date_only": false, "value": "2026-11-06T11:40:49.447291Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88800", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-06T11:40:49.447Z", "date_only": false, "value": "2026-11-06T11:40:49.447291Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88800", "record": "FKIE_CVE-2026-88800", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-06T11:50:25.744Z", "date_only": false, "value": "2026-11-06T11:50:25.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T11:50:25.744Z", "date_only": false, "value": "2026-11-06T11:50:25.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88800", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T20:09:13.780Z", "date_only": false, "value": "2026-11-06T20:09:13.780", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88800", "record": "FKIE_CVE-2026-88800", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T22:52:04.635Z", "date_only": false, "value": "2026-11-12T22:52:04.635534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/aeczcq3odzcvl", "record": "CVE-2026-88800", "field": "creation_timestamp", "uuid": "55bec873-727a-4f26-9bc2-c47e05de1658", "content": "\ud83d\udea8 CVE-2026-88800\nCVSS 9.1 / EPSS 0.31% / KEV: No\nTL;DR: The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no\u2026\nhttps://cvesentinel.com/report/CVE-2026-88800\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/aeczcq3odzcvl"}], "metrics": {"as_of": "2026-11-14T02:16:27.040Z", "anchors": {"origin": {"timestamp": "2026-11-06T07:30:54.070Z", "date_only": false, "value": "2026-11-06T07:30:54.070Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T07:30:54.070Z", "date_only": false, "value": "2026-11-06T07:30:54.070Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 672332.97062, "hours": 186.75915850555558, "days": 7.781631604398148, "min_seconds": 672332.97062, "max_seconds": 672332.97062, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T07:30:54.070Z", "date_only": false, "value": "2026-11-06T07:30:54.070Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88800", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T02:16:27.040Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}