Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

Vulnerability

The Modern Events Calendar Lite WordPress plugin versions before 5.16.5 contains an arbitrary file upload vulnerability. The plugin fails to properly check the imported file, allowing PHP files to be uploaded by an administrator by using the 'text/csv' content-type in the request [1].

Exploitation

An attacker with administrator privileges can upload a PHP file by crafting a request with the content-type set to 'text/csv'. The vulnerability could also be exploited via a CSRF attack, as such check is missing [1].

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to remote code execution (RCE) and full compromise of the WordPress site.

Mitigation

The vulnerability is fixed in version 5.16.5 of the plugin. Users should update to the latest version immediately [1].