CVE-2021-24146
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
HIGH 7.5EPSS 31.0%
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
- Affected
- Modern Events Calendar Lite
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N - EPSS
- 31.04% chance of exploitation in the next 30 days, 98th percentile
- Nuclei
- high
- Published
- 2021-03-18
- Updated
- 2024-08-03
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Infor…
- https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc