PT-2026-23811 · WordPress · Mdjm Event Management

Abhirup Konwar · Published 2026-03-07 · Updated 2026-03-07 · CVE-2026-1650

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MDJM Event Management plugin for WordPress versions prior to 1.7.8.2

Description The MDJM Event Management plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the custom fields controller function. Unauthenticated attackers can delete arbitrary custom event fields by manipulating the 'delete custom field' and id parameters.

Recommendations Update the MDJM Event Management plugin to version 1.7.8.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1650

Affected Products

Mdjm Event Management

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1650 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cb309336-5b35-45cf-9c58-4bb75d8a5cba?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2030150365258162512 · Twitter Post
• https://plugins.trac.wordpress.org/browser/mobile-dj-manager/trunk/includes/admin/pages/event-fields.php#L100 · Note
• https://t.me/cveNotify/154560 · Telegram Post
• https://twitter.com/infoflowcloud/status/2030340396740473262 · Twitter Post
• https://t.me/CVEtracker/46675 · Telegram Post
• https://plugins.trac.wordpress.org/browser/mobile-dj-manager/tags/1.7.7/includes/admin/pages/event-fields.php#L100 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464190%40mobile-dj-manager&new=3464190%40mobile-dj-manager&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2030339365013180917 · Twitter Post