Hackers target WordPress calendar plugin used by 150,000 sites

Share:

Hackers are trying to exploit a vulnerability in the Modern Events Calendar WordPress plugin that is present on more than 150,000 websites to upload arbitrary files to a vulnerable site and execute code remotely.

The plugin is developed by Webnus and is used to organize and manage in-person, virtual, or hybrid events.

The vulnerability exploited in attacks is identified as CVE-2024-5441 and received a high-severity score (CVSS v3.1: 8.8). It was discovered and reported responsibly on May 20 by Friderika Baranyai during Wordfence’s Bug Bounty Extravaganza.

In a report describing the security issue, Wordfence says that the security issue stems from a lack of file type validation in the plugin’s ‘set_featured_image’ function, used for uploading and setting featured images for the events.

The function takes an image URL and post ID, tries to get the attachment ID, and if not found, downloads the image using the get_web_page function.

It retrieves the image using wp_remote_get or file_get_contents, and saves it to the WordPress uploads directory using file_put_contents function.

Modern Event Calendar versions up to and including 7.11.0 have no checks for the file type of extension in uploaded image files, allowing any file type, including risky .PHP files, to be uploaded.

Once uploaded, these files can be accessed and executed, enabling remote code execution on the server and potentially leading to complete website takeover.

Any authenticated user, including subscribers and any registered members, can exploit CVE-2024-5441.

If the plugin is set to allow event submissions from non-members (visitors without accounts), CVE-2024-5441 is exploitable without authentication.

Webnus fixed the vulnerability yesterday by releasing version 7.12.0 of Modern Event Calendar, which is the recommended upgrade to avoid the risk of a cyberattack.

However, Wordfence reports that hackers are already trying to leverage the issue in attacks, blocking over 100 attempts in 24 hours.

Given the ongoing exploitation efforts, users of the Modern Events Calendar and Modern Events Calendar Lite (free version) should to upgrade to the latest version as soon as possible or disable the plugin until they can perform the update.

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
3:34 am, Jul 14, 2025
weather icon 19°C
L: 18° | H: 20°
overcast clouds
Humidity: 75 %
Pressure: 1011 mb
Wind: 8 mph ESE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:59 am
Sunset: 9:12 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
18° | 20°°C 0 mm 0% 18 mph 76 % 1015 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
15° | 20°°C 1 mm 100% 15 mph 78 % 1016 mb 0 mm/h
Wed Jul 16 10:00 pm
weather icon
14° | 27°°C 0.2 mm 20% 14 mph 73 % 1017 mb 0 mm/h
Thu Jul 17 10:00 pm
weather icon
18° | 26°°C 1 mm 100% 8 mph 80 % 1017 mb 0 mm/h
Fri Jul 18 10:00 pm
weather icon
19° | 30°°C 0 mm 0% 12 mph 79 % 1015 mb 0 mm/h
Today 4:00 am
weather icon
18° | 19°°C 0 mm 0% 7 mph 75 % 1011 mb 0 mm/h
Today 7:00 am
weather icon
17° | 19°°C 0 mm 0% 9 mph 76 % 1011 mb 0 mm/h
Today 10:00 am
weather icon
20° | 20°°C 0 mm 0% 11 mph 59 % 1012 mb 0 mm/h
Today 1:00 pm
weather icon
23° | 23°°C 0 mm 0% 15 mph 39 % 1013 mb 0 mm/h
Today 4:00 pm
weather icon
25° | 25°°C 0 mm 0% 18 mph 28 % 1013 mb 0 mm/h
Today 7:00 pm
weather icon
22° | 22°°C 0 mm 0% 15 mph 30 % 1013 mb 0 mm/h
Today 10:00 pm
weather icon
19° | 19°°C 0 mm 0% 9 mph 45 % 1015 mb 0 mm/h
Tomorrow 1:00 am
weather icon
16° | 16°°C 0 mm 0% 8 mph 61 % 1016 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€102,437.02
1.91%
Ethereum(ETH)
€2,564.09
1.82%
XRP(XRP)
€2.46
4.66%
Tether(USDT)
€0.86
0.00%
Solana(SOL)
€140.09
1.66%
USDC(USDC)
€0.86
0.00%
Dogecoin(DOGE)
€0.171876
1.97%
Shiba Inu(SHIB)
€0.000012
2.89%
Pepe(PEPE)
€0.000010
1.30%
Peanut the Squirrel(PNUT)
€0.244556
5.81%
Scroll to Top