WordPress Plugin Vulnerable to Server-Side Request Forgery

CVE-2024-6522

Summary

The Modern Events Calendar plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability found in all versions up to 7.12.1. This security flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized web requests to internal services from the web application. By exploiting this vulnerability through the 'mec_fes_form' AJAX function, hackers can query and manipulate sensitive information, potentially leading to data leaks and other security incidents.

References