PT-2021-16381 · WordPress · Modern Events Calendar Lite

Krzysztof Zając

·

Published

2021-12-13

·

Updated

2024-12-05

·

CVE-2021-24946

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: The Modern Events Calendar Lite WordPress plugin versions prior to 6.1.5
Description: The issue is related to an unauthenticated SQL injection problem. It occurs because the time parameter is not properly sanitised and escaped before being used in a SQL statement within the mec load single page AJAX action. This action is accessible to unauthenticated users, making it possible for attackers to exploit without needing login credentials. The mec load single page AJAX action is the specific endpoint where this issue is present.
Recommendations: For versions prior to 6.1.5, update to version 6.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the mec load single page AJAX action to authenticated users only, until a patch is applied. Avoid using the time parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24946

Affected Products

Modern Events Calendar Lite