Modern Events Calendar CVE-2024-5441: Arbitrary File Upload to RCE on 150,000 WordPress Sites (CVSS 8.8)

A high-severity vulnerability in Modern Events Calendar, one of the most widely used event management plugins for WordPress, put more than 150,000 active sites at risk of complete compromise. Tracked as CVE-2024-5441, the flaw allowed low-privileged users—and in many configurations, completely unauthenticated visitors—to upload arbitrary files to the server, opening the door to remote code execution (RCE). Attackers began targeting the flaw in the wild within days of its disclosure, making it a textbook example of why keeping plugins patched is not optional.

If you run an events-driven site—a venue, conference, community calendar, or membership organization—this is one worth understanding. Below we break down what the vulnerability is, how it works, and exactly what you need to do to stay safe.

CVE Details at a Glance

• CVE ID: CVE-2024-5441
• Plugin: Modern Events Calendar (by Webnus)
• Affected versions: All versions up to and including 7.11.0
• Patched version: 7.12.0 (released July 8, 2024)
• Vulnerability type: Arbitrary File Upload (CWE-434) leading to Remote Code Execution
• CVSS 3.1 score: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Privileges required: Subscriber-level and above — or none, if guest event submission is enabled
• Active installations: 150,000+

How the Vulnerability Works

Modern Events Calendar lets users attach a featured image to an event they submit. The problem lived in the plugin’s set_featured_image function, which handled these image uploads. The function accepted a file from the user and saved it—but it never properly checked what kind of file it was receiving.

File type validation is the security control that ensures an “image upload” field only accepts actual images (like .jpg or .png) and rejects executable code. Because that check was missing, an attacker could hand the plugin a malicious PHP file disguised as a featured image. The plugin would happily save it into the WordPress uploads directory—a folder that is publicly reachable over the web.

Once a PHP file lands in a web-accessible directory, the attacker simply visits its URL in a browser. The server executes the code, handing the attacker a foothold. This is the classic path from “file upload bug” to “full remote code execution.”

What makes CVE-2024-5441 especially dangerous is how little access an attacker needed. At minimum, exploitation required only a Subscriber account—the lowest-privileged role on WordPress, and one that countless sites hand out freely through open registration. Worse, Modern Events Calendar includes a setting that lets site administrators allow unauthenticated visitors to submit events. On any site with that option enabled, an attacker needed no account at all—just an anonymous HTTP request was enough to plant a web shell.

Real-World Impact

Remote code execution is the most severe outcome a web vulnerability can have, because it hands the attacker control of the server rather than just a slice of data. Once CVE-2024-5441 is exploited, an attacker can typically:

• Install a persistent backdoor or web shell to retain access even after the plugin is updated
• Create rogue administrator accounts and take over the WordPress dashboard
• Steal database contents—user records, password hashes, customer details, and order data
• Inject spam, malicious redirects, or SEO poisoning that damages your search rankings and reputation
• Use the compromised server to attack other sites or distribute malware
• Deface or take the site offline entirely

This was not a theoretical risk. Security researchers observed active exploitation attempts against the flaw shortly after it was publicly disclosed, with attackers scanning the web for vulnerable installations. When a plugin with six figures of installs has a public RCE, automated attacks follow quickly.

How to Check If You’re Affected

Work through these steps to determine your exposure:

1. Confirm the plugin is installed. In your WordPress admin, go to Plugins → Installed Plugins and look for “Modern Events Calendar” (sometimes listed as MEC or Modern Events Calendar Lite).
2. Check the version number. The version is shown directly beneath the plugin name. If it reads 7.11.0 or lower, your site is vulnerable and needs to be updated immediately.
3. Review your guest submission setting. If you allow visitors to submit events without logging in, your risk is even higher—the flaw becomes fully unauthenticated. Treat updating as an emergency.
4. Look for signs of compromise. Inspect your wp-content/uploads folders for unexpected .php files, and review your user list for administrator accounts you don’t recognize.

How to Fix It

The fix is straightforward: update Modern Events Calendar to version 7.12.0 or later. The plugin’s developer, Webnus, added proper file type validation in 7.12.0, which closes the upload hole.

1. Go to Dashboard → Updates or Plugins → Installed Plugins in your WordPress admin.
2. If an update for Modern Events Calendar is available, click Update Now.
3. Confirm the version now reads 7.12.0 or higher.
4. Consider enabling automatic updates for this plugin so future security patches apply without delay.

Beyond the immediate patch, a few hardening steps meaningfully reduce the damage this class of vulnerability can do:

• Block PHP execution in the uploads directory. Adding a server rule that prevents any .php file in wp-content/uploads from running neutralizes most file-upload-to-RCE attacks, even before a patch exists.
• Disable guest event submission unless you genuinely need it, and require accounts to be reviewed.
• Audit your user roles. Don’t grant more privileges than necessary, and periodically remove stale or suspicious accounts.
• Run a Web Application Firewall (WAF). A good WAF can block malicious upload attempts and buy you time between disclosure and patching.
• If you suspect compromise, take the site offline, restore from a known-clean backup, rotate all passwords and secret keys, and scan thoroughly before bringing it back.

The Takeaway

CVE-2024-5441 is a reminder that the most dangerous vulnerabilities are often the simple ones: a single missing file-type check turned a routine “add an event photo” feature into a full server takeover on 150,000 sites. The defenses are equally simple—keep your plugins updated promptly, grant users the least privilege they need, and harden your uploads directory so that even a slipped-through file can’t execute. Security on WordPress is rarely about one clever trick; it’s about consistently doing the unglamorous basics before attackers find the gap.