CVE-2021-24145: Modern Events Calendar Lite plugin arbitrary file upload via CSV import

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows authenticated administrators to achieve remote code execution and public exploit code exists, but exploitation requires high privileges and the issue is not in CISA KEV.

What it is

The Modern Events Calendar Lite WordPress plugin before 5.16.5 failed to properly validate files during import, so a PHP file could be uploaded by sending it with a 'text/csv' content-type. Because the uploaded file is executable PHP, this turns a file-upload weakness into remote code execution on the WordPress host.

Impact

An attacker with administrator access can upload and execute arbitrary PHP, leading to full compromise of the WordPress site and potentially the underlying server.

Attack surface

Reached over the network through the plugin's import functionality; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N), so an authenticated administrator account is needed.

Exploitation

Public exploit code is referenced (Packet Storm shell upload and RCE write-ups, WPScan), and EPSS is very high at 0.872 (99.7th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update Modern Events Calendar Lite to 5.16.5 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Restrict and audit administrator accounts; enforce least privilege and strong unique credentials.
• Block uploads of PHP files at the web server or WAF layer regardless of declared content-type.
• Review the uploads directory for unexpected .php files and disable PHP execution there.

Detection

• Monitor the WordPress uploads directory for newly created .php or other executable files.
• Alert on import requests carrying a 'text/csv' content-type that result in non-CSV file writes.
• Audit administrator account activity and plugin import actions for anomalies.
• Check web server logs for POST requests to the plugin's import endpoints followed by access to uploaded files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.