Four WordPress plugins hit by critical site-takeover flaws (July 23)

On July 23, 2026, four WordPress extensions (plugins) were disclosed to carry serious flaws that can let a site be taken over. Three of them are rated 9.8 out of 10 — the top "critical" tier — and, worse, can be exploited by an attacker who is not even logged in.

The affected plugins are "GoDAM", which manages media such as video; "Customer Support Ticket System & Helpdesk", which handles inquiries; "MountDev AI MCP Connector", which connects WordPress to AI; and "MDJM Event Management", which manages DJ and event operations. Their uses vary, but they share the same core danger: the site can be controlled through an operation that should never be allowed.

The bottom line: the fix for all of them is simply to update each plugin to the latest version. There are no reports of real-world attacks yet, but once details are public, the sooner you update, the safer. We explain what happens, whether your site is affected, and how to fix it, in order. WordPress plugin flaws appear almost weekly; just recently, three admin-takeover flaws were disclosed on July 16.

What happened across the four

The four break into two types. One is where an attacker who is not logged in can attack directly from the outside (GoDAM, the support-ticket plugin, and the AI connector — three cases). The other is where a user registered with a low privilege level can escalate their own account to administrator (MDJM).

The entry points differ, but the destination is the same: gaining "the same power as the site owner." Once administrator rights are seized, or code can be run on the server, an attacker can effectively do anything — tampering with posts, planting fake pages, harvesting member data, or embedding other malware. That is why three of these carry the top severity score of 9.8.

All four are problems in WordPress plugins (extensions), not in WordPress core. In other words, sites that do not have these plugins are not affected. The starting point is to check whether your site has any of them and, if so, which version. Some are relatively small plugins with a few hundred installs, but "if you use it, you are affected" still holds.

Affected plugins and fixes at a glance

So you can judge at a glance whether your site is affected, here are the four side by side. If you fall under "affected versions," update to the "fixed version" on the right.

The severity numbers come from CVSS, a common yardstick that rates a flaw's seriousness out of 10. Scores of 9.0 and above fall in the top "Critical" tier — where the three flaws here sit. The remaining one, at 8.8, is still in the high "High" band and is not a number to put off.

Who targets this, and why

The kind of adversary who exploits these flaws is one who mechanically scans WordPress sites across the internet, looking for entry points where a targeted plugin is installed. Three of the flaws need no login at all — they work simply by sending attack data to a public page. For the remaining one, on any site that accepts member registration, anyone can create a low-privilege account to use as a foothold.

What that adversary then does is send malicious files or code to run programs on the server, or impersonate an administrator to control the entire site. In GoDAM and the support-ticket plugin, code is executed directly from outside; in the AI connector, the access key (token) tied to an administrator is stolen; and in MDJM, a low-privilege account is escalated to administrator.

Once administrator rights or server control are reached, the harm does not stop with the site operator. Visitors can be shown fake login or payment screens to steal their information, and the site can be used as a springboard for further attacks — so ordinary users who visit are harmed too. In the past, permission-related flaws have been targeted in concentrated waves, as in the takeover of miniOrange login plugins.

Details of the four flaws

Here is each one individually, with some technical background. It is fine to read only the entry for the plugin you use.

CVE-2026-14282: GoDAM (video / media management) — unauthenticated file upload

GoDAM is a plugin that manages and delivers media assets such as video on WordPress, built by the well-known WordPress agency rtCamp. The flaw (CVE-2026-14282) stems from insufficient file-type validation in an internal save routine (save_video_file()).

The routine trusts the user-supplied "file type (Content-Type)" as-is, bypasses WordPress's standard safety checks, and places the file directly in a web-accessible folder. As a result, an attacker who is not logged in can upload a malicious program file and ultimately run arbitrary code on the server. Versions 1.12.2 and below are affected, and updating to the latest version (currently the 2.0.0 line) resolves it. The severity is CVSS 9.8.

CVE-2026-15011: Customer Support Ticket System & Helpdesk (inquiry handling) — code execution

This is a support-intake plugin (by emarket-design) that manages site inquiries as tickets. The flaw (CVE-2026-15011) lets an attacker who is not logged in invoke arbitrary parameterless PHP functions through a path field.

Normally, this kind of operation requires a one-time secret (a nonce) to confirm it is legitimate. But in this plugin, that nonce is emitted onto the public page every time the inquiry form (the [emd_form] shortcode) is rendered. In other words, an attacker can obtain the secret without logging in, effectively neutralizing the check. Versions 6.0.5 and below are affected, and it was fixed in 6.0.6 (an update that closes a function-call hole in the file-deletion handler). The severity is CVSS 9.8.

CVE-2026-15015: MountDev AI MCP Connector (WordPress-to-AI link) — stealing an admin token

MountDev AI MCP Connector is a plugin that connects WordPress to AI agents such as ChatGPT and Claude. The bridge it uses is MCP (Model Context Protocol), a common mechanism for AI to operate external services. The flaw (CVE-2026-15015) stems from a missing authorization check that confirms whether an operation is actually permitted.

Specifically, a publicly accessible "Dynamic Client Registration" endpoint combines with an unprotected authorization endpoint, so an attacker who is not logged in can obtain, via a self-registered client, an OAuth access key (bearer token) bound to an administrator. With it, they can perform administrator-equivalent operations. As AI integration spreads rapidly, this is a new type of case where weak MCP authorization design is exploited — the same family of weakness seen in the MCP-related tool flaw where authorization gaps were the problem. Versions 1.6.1 and below are affected; update to the vendor's latest release. The severity is CVSS 9.8.

CVE-2026-15017: MDJM Event Management (DJ / event operations) — member escalates to admin

MDJM Event Management is a plugin for DJs and event operators to manage bookings, scheduling, and quotes. The flaw (CVE-2026-15017) is caused by missing capability checks and nonce verification, plus inadequate validation of the role-assignment parameters.

As a result, a user registered with a low privilege level such as subscriber can escalate their own account to administrator simply by slipping a forged role value into a request. On sites that allow open registration, anyone can reach this entry point. Versions 1.7.8.4 and below are affected; update to the vendor's latest release. The severity is CVSS 8.8. MDJM has had other flaws reported before, so it is a plugin where keeping to the latest version routinely matters especially.

What to do now

It is simple. From the WordPress admin screen, check and act in the following order.

The three that need no login (GoDAM, the support ticket, and the AI connector) can be targeted directly from outside if the plugin is present, so update them first. After updating, it is reassuring to confirm no unfamiliar accounts have been added to the administrator list and no suspicious files have been placed in public folders. If you find signs of tampering, consider resetting all passwords and restoring from backup.

For everyday defense, delete plugins you do not use and enable auto-update for the ones you keep. As we have repeatedly noted in past WordPress plugin vulnerability roundups, "install and forget" tends to be the biggest risk.

Summary

The four disclosed on July 23, 2026 differ in purpose but share the danger of the site being taken over. Three can be exploited without a login and carry the top severity of 9.8. Some are small plugins with only a few hundred installs, but "if you use it, you are affected" still holds. In particular, the MCP-integration flaw that links AI to WordPress is a new point to watch as AI adoption grows in site operations.

What you need to do is simply "update the affected plugin to the latest version" — nothing difficult. Start with the three that can be targeted without a login, and treat inspecting administrator accounts and files after updating as a natural stopping point. We will update this article if new information or real-world attacks are confirmed.

Sources

• ▸ NVD - CVE-2026-14282 (GoDAM)
• ▸ NVD - CVE-2026-15011 (Customer Support Ticket System & Helpdesk)
• ▸ NVD - CVE-2026-15015 (MountDev AI MCP Connector)
• ▸ NVD - CVE-2026-15017 (MDJM Event Management)
• ▸ WordPress.org - GoDAM plugin page
• ▸ WordPress.org - Customer Support Ticket System & Helpdesk plugin page
• ▸ Wordfence Intelligence - WordPress vulnerability database