CVE-2021-24946: Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24946?
The severity of CVE-2021-24946 is critical with a score of 9.8.
How does CVE-2021-24946 affect the Modern Events Calendar Lite WordPress plugin?
CVE-2021-24946 affects the Modern Events Calendar Lite WordPress plugin before version 6.1.5.
What is the vulnerability in CVE-2021-24946?
The vulnerability in CVE-2021-24946 is an unauthenticated SQL injection issue in the mec_load_single_page AJAX action of the Modern Events Calendar Lite WordPress plugin.
Is CVE-2021-24946 exploitable by unauthenticated users?
Yes, CVE-2021-24946 is exploitable by unauthenticated users.
How can I fix CVE-2021-24946?
To fix CVE-2021-24946, upgrade the Modern Events Calendar Lite WordPress plugin to version 6.1.5 or later.