No member can be expelled, but Article 7 allows the suspension of certain membership rights, including voting, to member states who are identified as violating the bloc's values. Identifying a state in this way needs all members except the state being investigated to agree, after this sanctions can be applied on a qualified majority. If this route was pursued, the biggest hurdle to sanctioning Hungary would probably be Slovakia, given their new leader's sympathetic towards many of Orban's views.
The inability to expel members though I do think is a flaw in the EU's constitution, and it should exist, but with stringent tests to be met to ensure it's not done on a whim (e.g. expulsion should only happen if certain violations occur, and/or repeat minor violations as determined by an independent committee).