SQL Injection in Modern Events Calendar Lite
CVE-2021-24946
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an una…
Vulnerability class: SQL Injection
EPSS: 0.601 (98.3th percentile) — read the EPSS interpretation.
Affected products
- Unknown Modern Events Calendar Lite — versions 6.1.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445 (x_refsource_MISC)
- packetstormsecurity.com/files/165742/WordPress-Modern-Events-Calendar-6.1-SQL-I… (x_refsource_MISC)
- github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-24946 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-24946?
- CVE-2021-24946 is a vulnerability in Modern Events Calendar Lite, classified under SQL Injection. Published 2021-12-13.
- Is CVE-2021-24946 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.