CVE-2021-24149: Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[postid] POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2021-24149?
CVE-2021-24149 is an authenticated SQL Injection vulnerability in the Modern Events Calendar Lite WordPress plugin versions before 5.16.6.
How severe is CVE-2021-24149?
CVE-2021-24149 has a severity score of 8.8 (high).
How does CVE-2021-24149 occur?
CVE-2021-24149 occurs due to unvalidated input in the mec_fes_form AJAX action when logged in as an author+ in the Modern Events Calendar Lite plugin.
Which software versions are affected by CVE-2021-24149?
Versions of the Modern Events Calendar Lite WordPress plugin before 5.16.6 are affected by CVE-2021-24149.
Is there a fix for CVE-2021-24149?
Yes, the fix for CVE-2021-24149 is to update the Modern Events Calendar Lite plugin to version 5.16.6 or newer.