VulnerabilityModified
CVE-2021-24145
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
HIGH 7.2EPSS 87.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 87.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 87.20% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- webnus/modern events calendar lite
- Source
- contact@wpscan.com
References
- http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.