CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

2021-03-1814:57:50

CWE-434

WPScan

www.cve.org

0.965 High

EPSS

Percentile

99.6%

JSON

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the ‘text/csv’ content-type in the request.

CNA Affected

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.16.5",
        "status": "affected",
        "version": "5.16.5",
        "versionType": "custom"
      }
    ]
  }
]