What is the CVSS score of CVE-2026-7537?

CVE-2026-7537 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MDJM Event Management are affected by CVE-2026-7537?

The MDJM Event Management WordPress plugin (through version 1.7.8.3) contains a remote code execution vulnerability allowing arbitrary file upload and execution on affected servers.

How to fix or mitigate CVE-2026-7537?

Within 24 hours: Audit all WordPress sites using MDJM Event Management plugin; review administrator account login logs and file upload activity for suspicious activity; document current plugin version in use. Within 7 days: Restrict administrator role to minimum necessary personnel; disable plugin if event management is non-critical; implement file upload restrictions at web server level to block PHP execution in upload directories. Within 30 days: Monitor vendor advisories for patch availability; evaluate migration to alternative event management solutions if patch remains unavailable.

MDJM Event Management CVE-2026-7537

EUVD-2026-34948 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-06 Wordfence

GHSA-9q5q-7m8w-wgxm

WordPress RCE File Upload Wordpress Plugin Mdjm Event Management

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:51 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

HIGH 7.2

DescriptionCVE.org

The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.

AnalysisAI

Remote code execution in the MDJM Event Management WordPress plugin (versions through 1.7.8.3) allows authenticated administrators to upload arbitrary files, including executable PHP, via the mdjm_send_comm_email function which performs no file type, extension, or MIME validation. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 score of 7.2, with publicly available exploit code existing on GitHub and a detailed write-up published by the researcher. No public exploit identified in CISA KEV, and exploitation requires administrator-level privileges, limiting realistic impact to post-compromise or insider scenarios.

Technical ContextAI

MDJM Event Management (mobile-dj-manager) is a WordPress plugin used by mobile DJ and event businesses to manage bookings, communications, and client interactions. The vulnerable code path resides in includes/admin/communications/comms-functions.php around lines 241 and 248, within the mdjm_send_comm_email function responsible for processing email attachments sent through the plugin's communications module. CWE-434 (Unrestricted Upload of File with Dangerous Type) applies because the function accepts uploaded files without validating extension, MIME type, or content, so an attacker can place a .php file into a web-accessible directory and request it to trigger PHP interpretation by the WordPress host. The CPE cpe:2.3:a:mdjm:mdjm_event_management:*:*:*:*:*:*:*:* indicates all versions up to and including 1.7.8.3 are affected.

RemediationAI

Upstream fix available (changeset 3528037 on plugins.trac.wordpress.org for mobile-dj-manager); a released patched version greater than 1.7.8.3 is not independently confirmed in the provided data, so administrators should monitor https://wordpress.org/plugins/mobile-dj-manager/ and update to the next release above 1.7.8.3 as soon as it is published, validating against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/42f37a41-deff-4b17-94d8-4e0fd1ce22c2?source=cve. Until a tagged release is available, deactivate the MDJM Event Management plugin if the communications/email feature is not business-critical, or restrict WordPress administrator accounts to a minimal set of strongly authenticated users with 2FA and IP allowlisting on /wp-admin to reduce the pool of accounts that can trigger the vulnerable mdjm_send_comm_email path. As compensating controls, deploy a WAF rule to block uploads with executable extensions (.php, .phtml, .phar) to the plugin's communications endpoint and configure the web server to deny PHP execution in wp-content/uploads/ via an .htaccess or nginx location block - the trade-off being that legitimate plugins relying on dynamic content under uploads may break and the WAF rule may interfere with normal email attachment workflows.