CVE-2024-5441: 
WordPress vulnerability analysis and mitigation

The Modern Events Calendar plugin for WordPress contains a critical vulnerability (CVE-2024-5441) discovered in versions up to 7.11.0. The vulnerability stems from missing file type validation in the set_featured_image function, affecting over 150,000 WordPress websites. This security flaw was identified and reported through the Wordfence Bug Bounty Program, earning the researcher known as Foxyyy a bounty of $3,094 (Wordfence Blog).

The vulnerability is characterized by a missing file type validation mechanism in the set_featured_image function, which allows for arbitrary file uploads. The flaw has been assigned a CVSS score of 8.8 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires low privileges, and can result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability enables authenticated attackers with subscriber-level access or higher to upload arbitrary files to the affected site's server, potentially leading to remote code execution. In configurations where the plugin settings allow guest event submissions, even unauthenticated attackers could exploit this vulnerability. This could result in complete site compromise through the use of webshells and other malicious techniques (Security Online).

The vulnerability is being actively exploited in the wild. Wordfence has detected and blocked 134 attacks exploiting this vulnerability within 24 hours of discovery. The ease of exploitation is heightened by the fact that even low-privileged users (subscribers) can trigger the vulnerability, and in some cases, unauthenticated attackers can exploit it if guest event submissions are enabled (Security Online).

Website administrators using the Modern Events Calendar plugin are strongly advised to update to version 7.12.0, which contains the necessary patch to fix this vulnerability. This update addresses the file type validation issue in the set_featured_image function (NVD).