CVE-2026-7537

Authenticated attackers with administrator-level access can exploit this vulnerability. They can upload malicious PHP files to the server via the `mdjm_send_comm_email` function, which lacks file type, extension, or MIME type validation [ref_id=1]. This allows for remote code execution by uploading executable files [ref_id=1]. The vulnerability occurs because user-controlled file data is processed directly without validation [ref_id=2].

The vulnerability exists within the `mdjm_send_comm_email()` function, located in `comms-functions.php`. The upload functionality within this function processes file attachments for email communications without adequate validation. Specifically, the `move_uploaded_file()` function at `comms-functions.php#L248` is called with user-controlled input from `$_FILES['mdjm_email_upload_file']` without prior sanitization or validation [ref_id=1].

The patch is not available in the provided bundle. The advisory recommends that users update to a version that addresses this vulnerability. Without a patch, the specific code changes are unknown, but the vulnerability is described as stemming from a lack of file validation in the `mdjm_send_comm_email` function [ref_id=1].

python3 ./CVE-2026-7537.py http://target-site.com admin password123 [+] Logging into: http://target-site.com/wp-admin [+] Extracting nonce values... [+] Uploading web shell: shell.php [+] Web Shell Location: http://target-site.com/wp-content/uploads/2026/02/shell.php [+] [+] Executing test command: id uid=33(www-data) gid=33(www-data) groups=33(www-data) [ref_id=1]