WordPress Plugin Vulnerable to Server-Side Request Forgery

CVE-2024-6522

What is CVE-2024-6522?

The Modern Events Calendar plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability found in all versions up to 7.12.1. This security flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized web requests to internal services from the web application. By exploiting this vulnerability through the 'mec_fes_form' AJAX function, hackers can query and manipulate sensitive information, potentially leading to data leaks and other security incidents.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References