CVE-2021-24145

CVE-2021-24145 describes an arbitrary file upload vulnerability in the Modern Events Calendar Lite WordPress plugin, affecting versions prior to 5.16.5. This flaw allows an authenticated administrator to upload malicious PHP files by manipulating the content-type to 'text/csv' during an import operation. Rated 7.2 HIGH on CVSS, the vulnerability presents a high risk due to its network-based attack vector and potential for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV, exploit modules are publicly available in Metasploit and Nuclei, and an ExploitDB entry exists, indicating readily accessible exploit code despite limited community discussion or media coverage.