CVE-2021-24145: unknown modern events calendar lite

CVSS: 7.2v3.1HighModified

Published 18-03-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-24145 is a high (CVSS 7.2) vulnerability in unknown modern events calendar lite. EPSS estimates a 87.20% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 5 public exploits are recorded. Fixed in 5.16.5.

Overall risk

56/100

0100

High · default modelHow is this calculated?

CVSS score

7.2/10

010

High · v3.1 (NVD)

EPSS score

87.20%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, exploit-database, metasploit

Timeline

18-03-2021
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.2v2.06.5

EPSS trend

Probability

87.20%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 87.20% on 18-09-2026

18-09-202618-10-2026

EPSS score

87.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (wpscan.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 5 exploits

exploit-databasephpUnverified
Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)
Maturity: poc
MetasploitremoteVerified
Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution
exploit/multi/http/wp_plugin_modern_events_calendar_rce
Maturity: weaponized