PT-2026-23811 · WordPress · Mdjm Event Management

Abhirup Konwar · Publicado 2026-03-07 · Atualizado 2026-03-07 · CVE-2026-1650

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MDJM Event Management plugin for WordPress versions prior to 1.7.8.2

Description The MDJM Event Management plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the custom fields controller function. Unauthenticated attackers can delete arbitrary custom event fields by manipulating the 'delete custom field' and id parameters.

Recommendations Update the MDJM Event Management plugin to version 1.7.8.2 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1650

Produtos afetados

Mdjm Event Management

Referências · 10

• https://wordfence.com/threat-intel/vulnerabilities/id/cb309336-5b35-45cf-9c58-4bb75d8a5cba?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2030150365258162512 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/mobile-dj-manager/trunk/includes/admin/pages/event-fields.php#L100 · Nota
• https://t.me/cveNotify/154560 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2030340396740473262 · Publicação no Twitter
• https://t.me/CVEtracker/46675 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1650 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.7/includes/admin/pages/event-fields.php#L100 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464190%40mobile-dj-manager&new=3464190%40mobile-dj-manager&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2030339365013180917 · Publicação no Twitter