CVE-2026-1650 is a missing authorization vulnerability (CWE-862) in the MDJM Event Management WordPress plugin. The issue arises because the 'custom_fields_controller' function does not perform capability checks before processing requests, enabling unauthenticated users to delete custom event fields by manipulating specific parameters. This affects all versions up to and including 1.7.8.1. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact.

An attacker without authentication can delete arbitrary custom event fields in the MDJM Event Management plugin, leading to unauthorized modification of event data integrity. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin's endpoints or disabling the plugin may reduce risk. Avoid exposing the WordPress installation to untrusted networks if possible.