Mdjm Event Management
Monthly
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Remote code execution in the MDJM Event Management WordPress plugin (versions through 1.7.8.3) allows authenticated administrators to upload arbitrary files, including executable PHP, via the mdjm_send_comm_email function which performs no file type, extension, or MIME validation. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 score of 7.2, with publicly available exploit code existing on GitHub and a detailed write-up published by the researcher. No public exploit identified in CISA KEV, and exploitation requires administrator-level privileges, limiting realistic impact to post-compromise or insider scenarios.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Remote code execution in the MDJM Event Management WordPress plugin (versions through 1.7.8.3) allows authenticated administrators to upload arbitrary files, including executable PHP, via the mdjm_send_comm_email function which performs no file type, extension, or MIME validation. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 score of 7.2, with publicly available exploit code existing on GitHub and a detailed write-up published by the researcher. No public exploit identified in CISA KEV, and exploitation requires administrator-level privileges, limiting realistic impact to post-compromise or insider scenarios.