Mdjm Event Management
Approved changes feed: RSS · Atom
cpe:2.3:a:mdjm:mdjm_event_management:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mdjm (cd1d6fcf-3a29-58b3-a9b3-4a1d32f42dce) |
|---|---|
| Product | Mdjm Event Management (23a4598e-4df3-518b-895a-319e2682f049) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15017 |
vulnerable | 2026-07-29 00:26:17.718893 |
MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
HIGH (8.8)
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.
Published: 2026-07-23T09:33:56.808Z
Updated: 2026-07-23T14:00:37.667Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7537 |
vulnerable | 2026-06-08 08:08:57.379581 |
MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter
HIGH (7.2)
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Published: 2026-06-06T02:28:35.320Z
Updated: 2026-06-06T11:48:22.401Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1650 |
vulnerable | 2026-06-08 07:49:09.120659 |
MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
MEDIUM (5.3)
The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'custom_fields_controller' function in all versions up to, and including, 1.7.8.1. This makes it possible for unauthenticated attackers to delete arbitrary custom event fields via the 'delete_custom_field' and 'id' parameters.
Published: 2026-03-07T01:21:23.469Z
Updated: 2026-04-08T17:23:25.055Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-31074 |
vulnerable | 2026-06-08 07:17:02.324990 |
WordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerability
HIGH (8.8)
Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.
Published: 2025-04-01T05:31:41.729Z
Updated: 2026-04-28T16:12:04.822Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.