MDJM Event Management EUVD-2026-77088

Either the MDJM Event Management plugin (version below 1.7.8.5) or the Mobile Events Manager plugin (version 1.4.8.3 or earlier) must be installed and activated on the target WordPress site. No authentication is required - the CVSS vector confirms PR:N, meaning any unauthenticated HTTP client that can reach the WordPress site can trigger the deletion. No special configuration or feature flag is needed beyond plugin activation in its default state. The primary limiting factor is that the attacker must supply a valid post ID, which WordPress assigns sequentially and can often be inferred or enumerated via public site content. The attack is bounded to content deletion only: no credential exposure, no code execution, and no privilege escalation are possible through this vector.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures the zero-barrier network exploitability - no authentication, no user interaction, and no complexity required. The I:H rating reflects that arbitrary content can be permanently destroyed, though A:N may be slightly understated since mass deletion of pages or media assets can functionally disrupt site availability. With a publicly available proof-of-concept from WPScan, exploitation is accessible to low-skilled attackers. EPSS data is not present in the provided input, so probabilistic exploitation likelihood cannot be quantified, but the absence of a CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis. Even a mid-sized municipal IT team in legnica running a WordPress-based events portal would need to treat this as urgent patching if either plugin is installed, given the trivial exploit path and irreversible impact of permanent content deletion.

An unauthenticated attacker identifies a WordPress site running a vulnerable version of MDJM Event Management or Mobile Events Manager - detectable via plugin file paths or response headers - then sends a crafted HTTP POST request to the plugin's playlist removal AJAX action with an arbitrary post ID. Because the handler skips all authorization, nonce, and type checks, WordPress permanently deletes the targeted content without placing it in the trash. A publicly available proof-of-concept lowers the skill threshold to near zero, and sequential post ID enumeration allows bulk destruction of site content.