The MDJM Event Management plugin for WordPress lacks a capability check in its custom_fields_controller function, enabling unauthenticated users to delete any custom event field using the delete_custom_field and id parameters. This flaw permits arbitrary data modification, potentially destroying or corrupting event information stored by the system. The weakness is classified as an Authorization Failure (CWE-862).

All WordPress installations running MDJM Event Management plugin versions up to and including 1.7.8.1 are affected. The vulnerability is present in every release up to that point and impacts the plugin’s administrative interface that manages custom event fields.

The CVSS base score of 5.3 indicates medium severity. EPSS reflects a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote and unauthenticated, via HTTP requests to the plugin’s event‑field controller endpoint, requiring no authentication credentials or elevated privileges.