CVE-2026-1650: 
WordPress vulnerability analysis and mitigation

CVE-2026-1650 is a Missing Authorization vulnerability in the MDJM Event Management plugin for WordPress that allows unauthenticated attackers to delete arbitrary custom event fields. It affects all versions of the plugin up to and including 1.7.8.1. The vulnerability was published on March 7, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is a missing capability check (CWE-862) on the custom_fields_controller function within the plugin's event fields administration page (includes/admin/pages/event-fields.php, line 100). Because no authorization is enforced before processing the action, any unauthenticated network request can invoke the delete_custom_field action by supplying the delete_custom_field and id parameters, causing the plugin to delete the targeted custom event field without verifying the requester's identity or privileges. The vulnerable code path is visible in the plugin's public source repository (Wordfence, WordPress Trac).

Successful exploitation allows any unauthenticated remote attacker to permanently delete custom event fields configured within the MDJM Event Management plugin, resulting in unauthorized data modification. There is no confidentiality or availability impact assessed; the primary risk is integrity loss — specifically, destruction of event management configuration data that site administrators have defined. While lateral movement potential is limited, repeated exploitation could degrade the operational functionality of event management workflows on affected WordPress sites (ENISA EUVD, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1650 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (ENISA EUVD, Wordfence).

1. Reconnaissance: Identify WordPress sites running the MDJM Event Management plugin (versions ≤ 1.7.8.1) using tools such as WPScan or by inspecting publicly accessible plugin metadata (e.g., readme.txt).
2. Enumerate custom field IDs: Observe or infer the numeric IDs of custom event fields, which may be discoverable through the WordPress admin interface if partially accessible, or by brute-forcing small integer values.
3. Craft malicious request: Construct an unauthenticated HTTP POST (or GET) request to the WordPress admin AJAX endpoint or the relevant admin page, including the parameters delete_custom_field=1 and id=<target_field_id>.
4. Submit request: Send the crafted request without any authentication cookies or nonce tokens, exploiting the missing capability check in custom_fields_controller.
5. Confirm deletion: Verify that the targeted custom event field has been removed from the plugin's configuration, confirming successful exploitation (Wordfence, WordPress Trac).

• Network: Unexpected unauthenticated HTTP requests to WordPress admin endpoints (e.g., wp-admin/) containing parameters delete_custom_field and id from external or unknown IP addresses.
• Logs: WordPress or web server access logs showing POST/GET requests to the MDJM event fields admin page without valid session cookies or nonce values, particularly from non-administrative source IPs.
• Application: Unexplained disappearance of custom event fields within the MDJM Event Management plugin configuration, especially if no administrator performed the deletion.

Users should update the MDJM Event Management plugin to a version beyond 1.7.8.1 that includes the capability check fix, as referenced in the plugin's changelog commit (WordPress Trac Changeset). As an interim workaround, site administrators can restrict access to WordPress admin pages via IP allowlisting at the web server or firewall level to prevent unauthenticated external requests from reaching the vulnerable endpoint. Regularly auditing installed plugin versions and applying updates promptly is the recommended long-term practice (Wordfence).

The vulnerability received routine automated coverage across CVE aggregation platforms and security feeds shortly after disclosure, with no notable researcher commentary or significant media coverage identified. Social media activity was limited to automated CVE notification accounts (Bluesky CVE Bot).