Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

Summary

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

Timeline

1. Mar 18, 2021, 2:57 PM UTCCVE published
2. Jul 2, 2021Public exploit on Exploit-DB

   EDB-50082

3. Aug 3, 2024, 7:21 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Unknown Modern Events Calendar Lite

  From 5.16.5 · fixed in 5.16.5

References 7