CVE-2021-24146: Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24146?
CVE-2021-24146 is a vulnerability in the Modern Events Calendar Lite WordPress plugin that allows unauthenticated users to export all events data in CSV or XML format.
What is the severity of CVE-2021-24146?
CVE-2021-24146 has a severity score of 7.5, which is considered high.
How does CVE-2021-24146 impact WordPress?
CVE-2021-24146 allows unauthenticated users to access and export all events data in CSV or XML format in the Modern Events Calendar Lite WordPress plugin.
Which version of the Modern Events Calendar Lite plugin is affected by CVE-2021-24146?
Versions of the Modern Events Calendar Lite plugin before 5.16.5 are affected by CVE-2021-24146.
Is there a fix for CVE-2021-24146?
Yes, upgrading to version 5.16.5 or later of the Modern Events Calendar Lite plugin fixes CVE-2021-24146.