PT-2024-36297 · WordPress · Modern Events Calendar
Foxyyy
+1
·
Published
2024-07-08
·
Updated
2025-03-28
·
CVE-2024-5441
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Modern Events Calendar plugin for WordPress versions up to, and including, 7.11.0
Description:
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the
set featured image function. This allows authenticated attackers with subscriber access and above to upload arbitrary files on the affected site's server, which may make remote code execution possible. The plugin also allows administrators to extend the ability to submit events to unauthenticated users, which would enable unauthenticated attackers to exploit this vulnerability. It is estimated that over 150,000 sites are at risk, and hackers are actively exploiting this flaw.Recommendations:
For Modern Events Calendar plugin for WordPress versions up to, and including, 7.11.0:
Upgrade to version 7.12.0 ASAP to patch the vulnerability.
As a temporary workaround, consider disabling the
set featured image function until a patch is available.
Restrict access to the plugin's event submission feature to minimize the risk of exploitation.
Avoid using the plugin until the issue is resolved.Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Modern Events Calendar