The MDJM Event Management plugin for WordPress exposes an arbitrary file upload vulnerability in the mdjm_send_comm_email function because no file type, extension, or MIME type validation is performed. An attacker with administrator-level or higher privileges can upload any file through the corresponding upload interface. If the uploaded file is executable on the web server, the attacker can run arbitrary code with the privileges of the WordPress process, potentially compromising the entire website and underlying host.

WordPress sites running MDJM Event Management version 1.7.8.3 or earlier are impacted. Versions newer than 1.7.8.3 include a patch that implements proper validation and removes the upload bypass.

The CVSS score of 7.2 places the issue in the high severity range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalogue, indicating no currently observed exploitation in the wild. The flaw requires authenticated access at the administrator level or higher, making the attack vector internal or requiring compromised credentials. Once authenticated, an attacker can immediately upload a malicious file and trigger remote code execution, granting full control over the WordPress installation and potentially the underlying server.