CVE-2026-7537: MDJM Event Management Plugin RCE Flaw

CVE-2026-7537 Overview

CVE-2026-7537 is an arbitrary file upload vulnerability in the MDJM Event Management plugin for WordPress. The flaw affects all versions up to and including 1.7.8.3. The mdjm_send_comm_email function fails to validate file type, file extension, or MIME type on uploaded attachments. Authenticated attackers with administrator-level privileges or higher can upload executable files to the server. Successful exploitation leads to remote code execution under the WordPress process context. The issue is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated administrators can upload executable PHP files through the communications email function, achieving remote code execution on the WordPress host.

Affected Products

MDJM Event Management plugin (also known as Mobile DJ Manager) for WordPress
All versions up to and including 1.7.8.3
WordPress installations exposing the plugin's communications email feature

Discovery Timeline

2026-06-06 - CVE-2026-7537 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-7537

Vulnerability Analysis

The MDJM Event Management plugin provides communication tools that allow site administrators to send emails to clients and employees. The mdjm_send_comm_email function accepts file attachments submitted through the admin interface. The handler stores uploaded files without inspecting their content type, file extension, or MIME type. An attacker authenticated as an administrator can attach a PHP file and have it written to a web-accessible location. Requesting the stored file from the browser triggers PHP execution, yielding remote code execution within the WordPress runtime.

The vulnerability requires high privileges, which limits exploitation to actors who have already compromised an administrator account or to malicious insiders. Combined with credential theft, session hijacking, or stolen API keys, the issue provides a direct path from administrative access to operating system command execution. The exploit prediction score (EPSS) currently sits at 0.358% with a percentile of 58.411.

Root Cause

The affected code path in includes/admin/communications/comms-functions.php (around lines 241 and 248) processes attachment uploads without enforcing an allow-list of safe file types. No checks verify the magic bytes, declared MIME type, or extension. PHP files, .phtml variants, and other server-executable formats pass through unchanged and land in a directory served by the web server.

Attack Vector

The attack vector is network-based and authenticated. An administrator-level user submits the communications email form with a malicious attachment. The plugin saves the file inside the WordPress uploads area. The attacker then requests the file URL directly, causing the web server to execute the embedded PHP payload. Public proof-of-concept material is available in the GitHub CVE-2026-7537 PoC repository and the Ryan Kozak CVE-2026-7537 Analysis.

No verified exploit code is reproduced here. Refer to the linked technical write-ups and the Wordfence Vulnerability Report for detailed reproduction steps.

Detection Methods for CVE-2026-7537

Indicators of Compromise

New PHP, .phtml, or other executable files within the wp-content/uploads/mdjm/ directory tree or other MDJM-managed paths
HTTP POST requests to admin.php referencing MDJM communications endpoints with multipart attachments containing script extensions
Outbound network connections initiated by the PHP-FPM or web server process shortly after a file upload event
Unexpected web shells, cron entries, or scheduled tasks created by the WordPress process user

Detection Strategies

Monitor file integrity within the wp-content/uploads/ directory and alert on creation of files with executable extensions
Inspect web server access logs for sequential requests that upload a file followed by a direct GET to that file path
Correlate WordPress admin authentication events with subsequent uploads through the MDJM communications interface
Hunt for PHP files containing common web shell signatures such as eval(, base64_decode(, system(, or passthru(

Monitoring Recommendations

Enable WordPress audit logging for administrative actions, plugin operations, and media uploads
Forward web server, PHP error, and WordPress audit logs to a centralized analytics platform for correlation
Alert on any process spawned by the web server user that is not part of the normal application baseline
Track installed plugin versions across the WordPress estate and flag MDJM installations at version 1.7.8.3 or earlier

How to Mitigate CVE-2026-7537

Immediate Actions Required

Update the MDJM Event Management plugin to a release later than 1.7.8.3 once available from the vendor
Audit administrator accounts and rotate credentials, enforcing multi-factor authentication on all privileged users
Search the wp-content/uploads/ tree for unexpected executable files and remove any confirmed web shells
Review WordPress user activity logs for unauthorized admin sessions or unusual communication email events

Patch Information

The fix is tracked in the WordPress plugin repository. See the WordPress Changeset and the affected code locations referenced in the WordPress Comms Functions Code for context. Apply the latest plugin update through the WordPress admin dashboard or by replacing plugin files on disk.

Workarounds

Deactivate the MDJM Event Management plugin until a patched version can be installed
Restrict the communications email feature by limiting administrator-level access to a minimal set of trusted accounts
Block PHP execution within the wp-content/uploads/ directory using web server configuration to neutralize uploaded scripts
Place the WordPress administration interface behind an IP allow-list or VPN to limit exposure of privileged endpoints

bash

# Apache: disable PHP execution in uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>