CVE-2024-5441: Modern Events Calendar RCE Vulnerability

CVE-2024-5441 Overview

CVE-2024-5441 is an arbitrary file upload vulnerability in the Modern Events Calendar plugin for WordPress, developed by Webnus. The flaw resides in the set_featured_image function, which fails to validate uploaded file types. All versions up to and including 7.11.0 are affected. Authenticated attackers with subscriber-level access or higher can upload arbitrary files to the server, potentially enabling remote code execution. When administrators configure the plugin to allow unauthenticated event submissions, the vulnerability becomes exploitable without authentication. The issue is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Attackers can upload malicious PHP files to vulnerable WordPress sites and execute arbitrary code with web server privileges, leading to full site compromise.

Affected Products

Webnus Modern Events Calendar (all versions through 7.11.0)
Webnus Modern Events Calendar Lite for WordPress
WordPress sites with the plugin enabled and event submission features configured

Discovery Timeline

2024-07-09 - CVE-2024-5441 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-5441

Vulnerability Analysis

The Modern Events Calendar plugin exposes a set_featured_image function that handles image uploads tied to event submissions. The function processes user-supplied files but omits validation of the file extension and MIME type. Attackers can substitute the expected image with a PHP script or other executable payload. Once written to a web-accessible directory, the file can be requested directly to trigger code execution under the web server's user context.

The vulnerability falls under the Arbitrary File Upload class and maps to CWE-434. According to the EPSS data published on 2026-05-15, the probability of exploitation activity ranks in the 95th percentile, indicating elevated attacker interest relative to other published CVEs.

Root Cause

The root cause is missing input validation in the file upload handler. The set_featured_image function accepts files without enforcing an allowlist of permitted extensions or verifying MIME types against the actual file content. Server-side checks for executable content are absent, allowing PHP, phtml, and similar handler-mapped extensions to reach the upload destination.

Attack Vector

The attack is network-based and requires low privileges by default. An attacker authenticates as a subscriber, then submits an event with a crafted file attachment posing as a featured image. The server stores the file under the uploads directory, where the attacker can request it through HTTP to execute embedded code. When the plugin's settings permit unauthenticated event submissions, the prerequisite for authentication is removed entirely, broadening the attack surface to any internet-based adversary.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for the original advisory.

Detection Methods for CVE-2024-5441

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar written to wp-content/uploads/ subdirectories associated with the Modern Events Calendar plugin
HTTP POST requests to event submission endpoints carrying multipart payloads with non-image MIME content
Outbound network connections originating from the PHP-FPM or web server process to unexpected hosts shortly after a file upload
New WordPress administrator accounts created without corresponding admin-initiated workflows

Detection Strategies

Scan plugin upload directories for files whose extensions do not match expected image formats (.jpg, .png, .gif, .webp)
Monitor web server access logs for direct GET requests to files inside wp-content/uploads/ that return executable responses
Inspect WordPress core and plugin file integrity using tooling such as wp-cli checksum verification
Alert on POST requests to Modern Events Calendar AJAX actions and event submission handlers from low-privilege users

Monitoring Recommendations

Enable verbose logging on the web server and forward access logs to a centralized analytics platform for correlation
Track file creation events in the WordPress uploads directory using filesystem auditing tools
Review user role assignments regularly, particularly subscriber accounts created shortly before suspicious upload activity
Monitor for process spawns from PHP interpreters that invoke shells, downloaders, or system reconnaissance commands

How to Mitigate CVE-2024-5441

Immediate Actions Required

Update Modern Events Calendar to a version later than 7.11.0 that addresses the file upload validation flaw
Audit subscriber and contributor accounts for unauthorized registrations and remove suspicious users
Inspect the WordPress uploads directory for unexpected executable files and remove or quarantine them
Disable unauthenticated event submission in the plugin settings until the patch is applied

Patch Information

Webnus released a fixed version of Modern Events Calendar that adds file type validation to the set_featured_image function. Administrators should upgrade to the latest release available from the Webnus Modern Events Calendar product page. Confirm the installed version through the WordPress plugins screen after upgrade.

Workarounds

Deactivate the Modern Events Calendar plugin until the patched version is deployed
Restrict execution of PHP files within the wp-content/uploads/ directory using web server configuration
Apply web application firewall rules that block multipart uploads containing PHP tags or executable headers to plugin endpoints
Require administrator approval for new user registrations to limit subscriber-level access

bash

# Apache: block PHP execution in WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx equivalent in the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}