← Vulnerability feed

Vulnerability record · CVE-2024-5441 · published 9 July 2024

CVE-2024-5441: Webnus modern events calendar unrestricted file upload vulnerability

Webnus · Modern Events Calendar

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.

8.8 CVSS 3.1 High EPSS 1.1% · top 35.3% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://webnus.net/modern-events-calendar/ Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve Third Party Advisory
https://webnus.net/modern-events-calendar/ Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve Third Party Advisory

Track CVE-2024-5441 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-4458Webnus modern events calendar lite sql injection vulnerabilityThe Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX…EPSS 0.35%9.8CVE-2021-24946Modern Events Calendar Lite unauthenticated SQL injectionThe Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise or escape the time parameter before using it in a SQL statement withi…EPSS 73%analysed9.6CVE-2024-6522Webnus modern events calendar server-side request forgery (ssrf) vulnerabilityThe Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'me…EPSS 0.40%8.8CVE-2021-24149Webnus modern events calendar lite sql injection vulnerabilityUnvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in th…EPSS 1.5%7.5CVE-2021-24146Webnus modern events calendar lite improper access control vulnerabilityLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the exp…EPSS 31%7.2CVE-2021-24145Modern Events Calendar Lite plugin arbitrary file upload via CSV importThe Modern Events Calendar Lite WordPress plugin before 5.16.5 failed to properly validate files during import, so a PHP file could be uploaded by se…EPSS 87%analysed6.1CVE-2021-24925Webnus modern events calendar lite cross-site scripting vulnerabilityThe Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_m…EPSS 0.80%5.4CVE-2022-30533Webnus modern events calendar lite cross-site scripting vulnerabilityCross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitr…EPSS 0.55%

Source: NIST National Vulnerability Database (record CVE-2024-5441), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.