CVE-2026-7537: MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

Synopsis

An arbitrary file upload vulnerability affects the MDJM Event Management WordPress plugin in all versions up to and including 1.7.8.3. The flaw is reachable over the network and requires an attacker to hold an administrator-level account, but once authenticated, the attacker can upload executable files through the mdjm_send_comm_email function because no file type, extension, or MIME type validation is enforced. Successful exploitation enables remote code execution on the host. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment upstream ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable endpoint is exposed via the standard HTTP interface.

• AuthenticationRequired

  An administrator-level account or higher is needed; a low-privilege account is not sufficient to reach the vulnerable upload function.

• Victim interactionNot required

  No user interaction is required; the attacker exercises the upload function directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond holding an admin credential.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, achieving full remote code execution on the WordPress host.
• All data accessible to the web server process is readable, including database credentials, configuration files, and stored user records.
• Attacker can write or overwrite files on the server, modifying plugin code, theme files, or other persisted content.
• The web server process can be crashed or monopolized, taking the WordPress site offline.