Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by usi...

CVE-2021-24145 · published 5 years ago
Summary

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

What to do
  • Update webnus modern_events_calendar_lite to version 5.16.5 or later.
Affected software
VendorProductAffected versions
webnus modern_events_calendar_lite < 5.16.5
cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*
Original advisory text
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by usi...
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
87% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published18 Mar 2021
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2021-24145 · NVD
Track software like this
Free during beta