The MDJM Event Management and Mobile Events Manager WordPress plugins are vulnerable to an unauthenticated arbitrary deletion flaw, posing a severe risk of data loss and site destruction.

The vulnerability is caused by a failure to perform capability checks, nonce validation, or record type verification during playlist entry removal. This missing authorization allows unauthenticated remote attackers to trigger the permanent deletion of arbitrary posts, pages, and media files.

Successful exploitation of this vulnerability results in the unauthorized, permanent destruction of site content, bypassing the standard trash functionality. Given the CVSS score of 7.5, this high-severity flaw could lead to significant operational disruption, loss of critical business data, and severe reputational damage to organizations relying on these plugins for content management.

Immediate Action: Update the MDJM Event Management plugin to version 1.7.8.5 or later. If using the Mobile Events Manager plugin and no update is available, deactivate and remove the plugin immediately until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious requests directed at the plugin endpoints associated with playlist or post management. Monitor the site for unexpected content deletion or database integrity issues.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block unauthorized requests to administrative or management-related endpoints. Ensure regular, off-site backups are maintained to facilitate recovery in the event of malicious data destruction.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to site integrity due to the potential for unauthenticated, permanent data loss. Administrators must prioritize the immediate update of the MDJM Event Management plugin. If the plugin is not essential, the most effective security posture is to uninstall the affected software to eliminate the attack surface entirely.