CVE-2026-7537

HighCVSS 7.2

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

48th percentile - higher than 48% of all known CVEs

Summary

The MDJM Event Management plugin for WordPress up to version 1.7.8.3 is vulnerable to Arbitrary File Upload via the mdjm_send_comm_email function due to lack of file type, extension, or MIME type validation. This allows authenticated attackers with administrator-level access to upload executable files, leading to remote code execution.

Risk Assessment

An attacker with admin privileges could upload a malicious file and take over the WordPress server.

Recommendation

Update the MDJM Event Management plugin to the latest version or remove it if not essential.

Other vulnerabilities in MDJM Event Management

CVE-2026-15017High
The MDJM Event Management plugin for WordPress up to version 1.7.8.4 contains a privilege escalation vulnerability due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, allowing unauthenticated attackers to grant arbitrary MDJM capabilities to any WordPress role and escalate to Administrator.

Original NVD description (English source)

The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.