CVE-2021-24145: Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-24145.
What is the severity rating of CVE-2021-24145?
CVE-2021-24145 has a severity rating of 7.2 (high).
What is the affected software?
The affected software is the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5.
How does the vulnerability in CVE-2021-24145 work?
The vulnerability allows an administrator to upload PHP files by using the 'text/csv' content-type in the request, bypassing proper file checks.
Where can I find more information about CVE-2021-24145?
You can find more information about CVE-2021-24145 at the following references: [Reference 1](http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html), [Reference 2](http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html), [Reference 3](https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610).