CVE-2021-24146

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

31.04% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high

Published

2021-03-18

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Infor…
• https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24146.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50084

References

• CVE Record
• NVD entry

Related

• CVE-2021-24145
• CVE-2021-24147
• CVE-2021-24139
• CVE-2021-24149
• CVE-2021-24138
• CVE-2021-24150