Hackers target WordPress calendar plugin used by 150,000 sites

Share:

Hackers are trying to exploit a vulnerability in the Modern Events Calendar WordPress plugin that is present on more than 150,000 websites to upload arbitrary files to a vulnerable site and execute code remotely.

The plugin is developed by Webnus and is used to organize and manage in-person, virtual, or hybrid events.

The vulnerability exploited in attacks is identified as CVE-2024-5441 and received a high-severity score (CVSS v3.1: 8.8). It was discovered and reported responsibly on May 20 by Friderika Baranyai during Wordfence’s Bug Bounty Extravaganza.

In a report describing the security issue, Wordfence says that the security issue stems from a lack of file type validation in the plugin’s ‘set_featured_image’ function, used for uploading and setting featured images for the events.

The function takes an image URL and post ID, tries to get the attachment ID, and if not found, downloads the image using the get_web_page function.

It retrieves the image using wp_remote_get or file_get_contents, and saves it to the WordPress uploads directory using file_put_contents function.

Modern Event Calendar versions up to and including 7.11.0 have no checks for the file type of extension in uploaded image files, allowing any file type, including risky .PHP files, to be uploaded.

Once uploaded, these files can be accessed and executed, enabling remote code execution on the server and potentially leading to complete website takeover.

Any authenticated user, including subscribers and any registered members, can exploit CVE-2024-5441.

If the plugin is set to allow event submissions from non-members (visitors without accounts), CVE-2024-5441 is exploitable without authentication.

Webnus fixed the vulnerability yesterday by releasing version 7.12.0 of Modern Event Calendar, which is the recommended upgrade to avoid the risk of a cyberattack.

However, Wordfence reports that hackers are already trying to leverage the issue in attacks, blocking over 100 attempts in 24 hours.

Given the ongoing exploitation efforts, users of the Modern Events Calendar and Modern Events Calendar Lite (free version) should to upgrade to the latest version as soon as possible or disable the plugin until they can perform the update.

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
10:38 pm, Jul 5, 2025
weather icon 20°C
L: 18° | H: 21°
broken clouds
Humidity: 78 %
Pressure: 1011 mb
Wind: 10 mph WSW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 75%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:50 am
Sunset: 9:19 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
18° | 21°°C 1 mm 100% 11 mph 85 % 1010 mb 0 mm/h
Mon Jul 07 10:00 pm
weather icon
13° | 20°°C 1 mm 100% 13 mph 92 % 1015 mb 0 mm/h
Tue Jul 08 10:00 pm
weather icon
13° | 24°°C 0 mm 0% 11 mph 78 % 1020 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0 mm 0% 7 mph 67 % 1022 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 5 mph 55 % 1023 mb 0 mm/h
Tomorrow 1:00 am
weather icon
19° | 19°°C 0 mm 0% 8 mph 79 % 1010 mb 0 mm/h
Tomorrow 4:00 am
weather icon
18° | 18°°C 0 mm 0% 6 mph 85 % 1009 mb 0 mm/h
Tomorrow 7:00 am
weather icon
20° | 20°°C 0 mm 0% 7 mph 80 % 1006 mb 0 mm/h
Tomorrow 10:00 am
weather icon
19° | 19°°C 1 mm 100% 7 mph 85 % 1005 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
19° | 19°°C 1 mm 100% 9 mph 79 % 1005 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
19° | 19°°C 1 mm 100% 10 mph 77 % 1005 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
21° | 21°°C 1 mm 100% 11 mph 53 % 1005 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
18° | 18°°C 0.44 mm 44% 9 mph 60 % 1007 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€91,803.20
0.34%
Ethereum(ETH)
€2,136.11
1.05%
Tether(USDT)
€0.85
0.01%
XRP(XRP)
€1.88
-0.15%
Solana(SOL)
€125.07
0.44%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.139324
1.15%
Shiba Inu(SHIB)
€0.000009
1.07%
Pepe(PEPE)
€0.000008
1.37%
Scroll to Top