What’s Vulnerable › Vulnerabilities

CVE-2021-24145: Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 87.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-18 · updated 2026-06-17
• Weakness: CWE-434

Description

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

Affected products

• Modern Events Calendar Lite: before 5.16.5 — fixed in 5.16.5

How to fix

Upgrade to a fixed version: Modern Events Calendar Lite 5.16.5. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
• http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html
• https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
• http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
• http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html
• https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610

Get alerted when CVE-2021-24145 or the next vulnerability affects your stack