CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Explanation of Vulnerability in Simple Terms
MDJM Event Management versions up to 1.7.8.3 contain an unrestricted file upload vulnerability. An authenticated administrator can upload files without proper validation, potentially allowing them to upload malicious files to the server. This could lead to unauthorized access, data theft, or site compromise depending on where uploaded files are stored and executed.
What an attacker can do
Upload files without validation to the server, potentially including executable code.
Potential impact on your site
An admin account compromise could allow file uploads leading to full site takeover or data breach.
Conditions required to exploit
Attacker must have administrator-level access to the MDJM Event Management system.
Key dates
External resources
Related vulnerabilities
