CVE-2021-24145
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Record
CVE-2021-24145- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Record
CVE-2021-24145- Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2021-11059 No score
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Record
EUVD-2021-11059- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5vmg-gchf-rcpm No score
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5...
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Record
GHSA-5vmg-gchf-rcpm- Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Record
CVE-2021-24145- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated) | 2021-07-02 |
| Metasploit | Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution | 2021-01-29 |
| Nuclei | WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload | |
| PoC in GitHub | dnr6419/CVE-2021-24145 | 2021-08-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24145 is a high vulnerability (CVSS 7.2) in Unknown Modern Events Calendar Lite, published March 18, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.2%, the 99th percentile. No source names a fixed version.
References
wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
nvd.nist.gov/vuln/detail/CVE-2021-24145
github.com/advisories/GHSA-5vmg-gchf-rcpm