CVE-2024-5441
📋 TL;DR
The Modern Events Calendar WordPress plugin allows arbitrary file uploads due to missing file type validation in the set_featured_image function. This enables authenticated attackers (subscriber-level or higher) to upload malicious files, potentially leading to remote code execution. The vulnerability can also be exploited by unauthenticated users if administrators have enabled event submissions for guests.
💻 Affected Systems
- Modern Events Calendar WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, malware deployment, or website defacement.
Likely Case
Unauthorized file uploads leading to webshell installation, backdoor persistence, or limited server access.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Exploitation requires subscriber-level access or unauthenticated access if guest submissions enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.11.1
Vendor Advisory: https://webnus.net/modern-events-calendar/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Modern Events Calendar. 4. Click 'Update Now' if available. 5. Alternatively, download version 7.11.1+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Guest Event Submissions
allPrevent unauthenticated exploitation by disabling guest event submissions in plugin settings.
Web Application Firewall Rule
allBlock file uploads to the vulnerable endpoint using WAF rules.
🧯 If You Can't Patch
- Disable the Modern Events Calendar plugin immediately
- Implement strict file upload restrictions at web server level (e.g., .htaccess rules blocking uploads to wp-content/uploads/mec)
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins > Installed Plugins.Check Version:
wp plugin list --name='Modern Events Calendar' --field=versionVerify Fix Applied:
Confirm plugin version is 7.11.1 or higher and test file upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-content/uploads/mec/
- POST requests to /wp-admin/admin-ajax.php with action=mec_featured_image
Network Indicators:
- File uploads with suspicious extensions (.php, .phtml, .exe) to calendar endpoints
SIEM Query:
source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="mec_featured_image")