Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

Summary

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.

Timeline

1. Mar 18, 2021, 2:57 PM UTCCVE published
2. Jul 2, 2021Public exploit on Exploit-DB

   EDB-50084

3. Aug 3, 2024, 7:21 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Unknown Modern Events Calendar Lite

  From 5.16.5 · fixed in 5.16.5

References 4