EUVD-2026-34948
GHSA-9q5q-7m8w-wgxm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain WordPress admin credentials
-
DeliveryAuthenticate to wp-admin
-
ExploitInvoke mdjm_send_comm_email upload
-
InstallWrite PHP webshell to uploads directory
-
C2Request shell URL over HTTP
-
ExecuteExecute commands as web server user
-
ImpactPivot to full host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the MDJM Event Management plugin (mobile-dj-manager) installed and activated at version 1.7.8.3 or earlier on a WordPress site, (2) a valid authenticated session with administrator-level capability or higher able to access the plugin's communications/email function, and (3) the uploads destination directory being served by a web server configured to execute PHP. The CVSS vector confirms PR:H (high privileges required) and UI:N (no user interaction), so the attack is unattended once admin access exists but the high-privilege requirement materially limits exploitation to insiders, compromised admin accounts, or multi-step chains following credential theft; it is not a remote unauthenticated bug. |
| Impact | The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity attack that nevertheless requires high privileges (administrator), which substantially limits the realistic attacker pool - an admin already has broad WordPress capabilities, so this primarily enables privilege escalation from app-admin to OS-level code execution on the web server. Publicly available exploit code exists (GitHub PoC by d0n601 and a write-up by Ryan Kozak), increasing the likelihood that opportunistic attackers who obtain admin credentials via phishing, credential stuffing, or supplementary vulnerabilities can chain into RCE. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild abuse cannot be asserted; absence of KEV does not preclude targeted exploitation. Overall this is a moderate-to-high real-world priority for sites running the plugin, particularly multi-admin or agency-managed WordPress instances where admin trust boundaries are weaker than commonly assumed. |
| Exploit ScenarioDerived | An attacker who has obtained WordPress administrator credentials - through phishing, credential reuse, or a prior compromise - logs into wp-admin and uses the MDJM communications module to send an email with a PHP webshell attached, which the vulnerable mdjm_send_comm_email function writes to a web-accessible uploads directory without validation. The attacker then requests the uploaded shell directly over HTTP to execute arbitrary code under the web server user, pivoting from WordPress admin to full server compromise. A public PoC is available at https://github.com/d0n601/CVE-2026-7537 and a walkthrough at https://ryankozak.com/posts/cve-2026-7537/, lowering the skill barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 06, 2026
Remote code execution in the MDJM Event Management WordPress plugin (versions through 1.7.8.3) allows authenticated administrators to upload arbitrary files, including executable PHP, via the mdjm_send_comm_email function which performs no file type, extension, or MIME validation. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 score of 7.2, with publicly available exploit code existing on GitHub and a detailed write-up published by the researcher. No public exploit identified in CISA KEV, and exploitation requires administrator-level privileges, limiting realistic impact to post-compromise or insider scenarios.
RemediationAI
Upstream fix available (changeset 3528037 on plugins.trac.wordpress.org for mobile-dj-manager); a released patched version greater than 1.7.8.3 is not independently confirmed in the provided data, so administrators should monitor https://wordpress.org/plugins/mobile-dj-manager/ and update to the next release above 1.7.8.3 as soon as it is published, validating against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/42f37a41-deff-4b17-94d8-4e0fd1ce22c2?source=cve. Until a tagged release is available, deactivate the MDJM Event Management plugin if the communications/email feature is not business-critical, or restrict WordPress administrator accounts to a minimal set of strongly authenticated users with 2FA and IP allowlisting on /wp-admin to reduce the pool of accounts that can trigger the vulnerable mdjm_send_comm_email path. As compensating controls, deploy a WAF rule to block uploads with executable extensions (.php, .phtml, .phar) to the plugin's communications endpoint and configure the web server to deny PHP execution in wp-content/uploads/ via an .htaccess or nginx location block - the trade-off being that legitimate plugins relying on dynamic content under uploads may break and the WAF rule may interfere with normal email attachment workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MDJM Event Management (mobile-dj-manager) is a WordPress plugin used by mobile DJ and event businesses to manage bookings, communications, and client interactions. The vulnerable code path resides in includes/admin/communications/comms-functions.php around lines 241 and 248, within the mdjm_send_comm_email function responsible for processing email attachments sent through the plugin's communications module. CWE-434 (Unrestricted Upload of File with Dangerous Type) applies because the function accepts uploaded files without validating extension, MIME type, or content, so an attacker can place a .php file into a web-accessible directory and request it to trigger PHP interpretation by the WordPress host. The CPE cpe:2.3:a:mdjm:mdjm_event_management:*:*:*:*:*:*:*:* indicates all versions up to and including 1.7.8.3 are affected.
Know when Mdjm Event Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Executive ViewAI
The MDJM Event Management WordPress plugin (through version 1.7.8.3) contains a remote code execution vulnerability allowing arbitrary file upload and execution on affected servers. Organizations using this plugin face critical risk if administrator accounts are compromised or if insider threats exploit the unpatched vulnerability, with no vendor fix currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrator account privileges and monitor access; (2) Implement Web Application Firewall rules to block file uploads with executable extensions; (3) Disable PHP execution in WordPress upload directory via .htaccess or web server configuration; (4) Enable file integrity monitoring on /uploads directory; (5) Require multi-factor authentication for all administrator accounts; (6) Disable plugin entirely if functionality is deferrable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB