Modern Events Calendar Lite Wordpress Plugin - Unauthenticated Events Export (CVE-2021-24146)

Modern Events Calendar Lite Wordpress plugin server is affected by an Unauthenticated Events Export vulnerability, located in the wp-admin endpoint, that an unauthenticated attacker can use to to export all events data in CSV or XML format. The root cause of this vulnerability is that the plugin did not properly restrict access to the export files and was missing authorization checks.

The risk exists that a remote unauthenticated attacker can read all events present on the server.

Update the Wordpress plugin to a version higher than 5.6.5.

https://nvd.nist.gov/vuln/detail/CVE-2021-24146