CVE-2026-7537highCWE-434

CVE-2026-7537: fallo de gravedad alta en MDJM Event Management

MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

Publicada el

Seguir esta CVE+ Monitorear MDJM Event Management

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.2epss 0.7%
de la publicación al armael mismo día
Publicada en NVD6 jun
1ª PoC30 abr
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
mdjm · MDJM Event Management
PoCs públicas encontradas — 1
githubgithub.com/d0n601/CVE-2026-7537★ 0
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — MDJM Event Management

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-15017HIGHMDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' HandlersEPSS 0.7%CVE-2026-1650MEDIUMMDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field DeletionEPSS 0.3%