CVE-2021-24146

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
Unknown	Modern Events Calendar Lite	>= 5.16.5, < 5.16.5

References

http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8feccExploit, Third Party Advisory
http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8feccExploit, Third Party Advisory

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-241475.4Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise CVE-2021-241489.8A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allow CVE-2021-241498.8Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parame CVE-2021-24158.1Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Supported versions that are affected ar CVE-2021-241507.5The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Re CVE-2021-241517.2The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL i CVE-2021-241526.1The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.CVE-2021-241535.4A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filt CVE-2021-241544.9The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allo CVE-2021-241557.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP CVE-2021-241565.4Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaSc CVE-2021-241575.4Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a