CVE-2026-7537 is an arbitrary file upload vulnerability in the MDJM Event Management plugin for WordPress, present in all versions up to 1.7.8.3. The vulnerability arises because the mdjm_send_comm_email function does not perform any validation on file type, extension, or MIME type for uploaded files. This allows authenticated users with administrator or higher privileges to upload files that may be executable, potentially leading to remote code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented by the vendor as of the publication date.

Successful exploitation allows an authenticated administrator-level user to upload arbitrary files without restriction on type or extension. This can lead to remote code execution on the affected WordPress server, compromising confidentiality, integrity, and availability of the system. The vulnerability poses a high risk to sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the MDJM Event Management plugin if possible. Monitor for updates from the vendor regarding patches or mitigations.