CVE-2021-24146: 
WordPress vulnerability analysis and mitigation

The Modern Events Calendar Lite WordPress plugin, versions prior to 5.16.5, contained a lack of authorization checks vulnerability (CVE-2021-24146). The vulnerability was discovered and publicly disclosed on January 29, 2021, affecting the plugin's export functionality (WPScan).

The vulnerability was classified as an Access Control issue (CWE-284) with a CVSS score of 5.3 (medium). The security flaw stemmed from improper access control implementation in the plugin's export functionality, which failed to properly restrict access to the export files. The vulnerability was discovered by Nguyen Van Khanh from SunCSR (Sun* Cyber Security Research) (WPScan).

The vulnerability allowed unauthenticated users to export all events data in CSV or XML format from the affected WordPress installations. This could lead to unauthorized access to sensitive event information stored in the calendar system (WPScan).

The vulnerability could be exploited by accessing specific URLs in the WordPress admin area without authentication, specifically targeting the export functionality through paths like '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv' or the XML variant (WPScan).

The vulnerability was fixed in version 5.16.5 of the Modern Events Calendar Lite plugin. Users are advised to update to this version or later to protect against unauthorized data access (WPScan).