WordPress Plugin Vulnerable to Server-Side Request Forgery
CVE-2024-6522

9.6CRITICAL

Key Information:

Vendor

Wordpress
Status
Modern Events Calendar
Modern Events Calendar Lite
Vendor
CVE Published:
7 August 2024

What is CVE-2024-6522?

The Modern Events Calendar plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability found in all versions up to 7.12.1. This security flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized web requests to internal services from the web application. By exploiting this vulnerability through the 'mec_fes_form' AJAX function, hackers can query and manipulate sensitive information, potentially leading to data leaks and other security incidents.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/modern-events-calendar-lite...
https://plugins.trac.wordpress.org/browser/modern-events-...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2024-6522 : WordPress Plugin Vulnerable to Server-Side Request Forgery