VulnerabilityModified
CVE-2021-24146
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
HIGH 7.5EPSS 31.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 31.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 31.04% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-862
- Affected
- webnus/modern events calendar lite
- Source
- contact@wpscan.com
References
- http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8feccExploit, Third Party Advisory
- http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8feccExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.