Access violation vulnerability in MDJM Event Management 1.7.6

The MDJM Event Management plugin for WordPress has a security issue that allows hackers to gain higher-level access to user accounts. This happens because the plugin does not properly check a user’s identity before allowing them to change their password through the mdjm_validate_client_profile feature. This means that attackers who are logged in with at least Subscriber-level permissions can change anyone’s password, including administrators, and use that to take control of their account.