CVE-2021-24145

2021-03-1815:15:15

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.965 High

EPSS

Percentile

99.6%

JSON

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the ‘text/csv’ content-type in the request.

CPENameOperatorVersion
modern-events-calendar-liteeq5.1.5
modern-events-calendar-liteeq5.2.6
modern-events-calendar-liteeq4.7.7
modern-events-calendar-liteeq5.16.1
modern-events-calendar-liteeq5.6.1
modern-events-calendar-liteeq5.2.5
modern-events-calendar-liteeq5.8.5
modern-events-calendar-liteeq5.2.0
modern-events-calendar-liteeq5.3.0
modern-events-calendar-liteeq5.4.5

Name	Operator	Version
modern-events-calendar-lite	eq	5.1.5
modern-events-calendar-lite	eq	5.2.6
modern-events-calendar-lite	eq	4.7.7
modern-events-calendar-lite	eq	5.16.1
modern-events-calendar-lite	eq	5.6.1
modern-events-calendar-lite	eq	5.2.5
modern-events-calendar-lite	eq	5.8.5
modern-events-calendar-lite	eq	5.2.0
modern-events-calendar-lite	eq	5.3.0
modern-events-calendar-lite	eq	5.4.5