CVE-2021-24145CWE-434

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

published March 18, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
87%
Percentile
99.8
In the wild
Unconfirmed
What it is

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.87201 · 99.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-03-18T14:57Z
EPSS history
Timeline
  • 18 MAR 14:57Z
    Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
    cvelistv5