CVE-2021-24145 | BDVDB-2026-150621 Detail

Modern Events Calendar Lite

Description#

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-434 Unrestricted Upload of File with Dangerous Type

References#

https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html

Exploit#

No public exploit known

History#

Version 12021-03-18Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.