CRITICAL
Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery
Published Aug 7, 2024
9.6
CRITICALCVSS 3.1
EPSS 0.40%
Description
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected products
-
- Version 0StatusaffectedConstraints<=7.12.1
- Version
-
- Version 0StatusaffectedConstraints<=7.12.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Webnus | Modern Events Calendar | unaffected |
| ||||||
| Webnus/ | Modern Events Calendar Lite | unaffected |
|
OR
- < 7.13.0
- < 7.13.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47603 Advisory
- https://mec.webnus.net/change-log/ Release Notes
- https://plugins.trac.wordpress.org/browser/modern-events-calendar-lite/trunk/app/features/fes.php#L54 Product
- https://wordpress.org/plugins/modern-events-calendar-lite/#developers Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/00bf8f2f-6ab4-4430-800b-5b97abe7589e?source=cve Third Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Aug 7, 2024
Updated Apr 8, 2026
Reserved Jul 4, 2024
Link CVE-2024-6522
CISA Vulnrichment
Updated Aug 7, 2024
ENISA EUVD
EUVD-2024-47603 Assigner Wordfence
Published Aug 7, 2024
Updated Apr 8, 2026
Exploited since n/a
Link EUVD-2024-47603