CVE-2024-6522: 
WordPress vulnerability analysis and mitigation

The Modern Events Calendar plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-6522) affecting all versions up to and including 7.12.1. The vulnerability exists in the 'mecfesform' AJAX function, allowing authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations originating from the web application (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and requires authenticated access with at least Subscriber-level privileges to exploit (NVD).

If exploited, the vulnerability allows attackers to query and modify information from internal services. The high CVSS score reflects the potential for significant data exposure and limited system modification capabilities through the SSRF attack vector (NVD).

The vulnerability was addressed in version 7.12.2 of the Modern Events Calendar plugin. Users are advised to update to this version or later to mitigate the vulnerability (MEC Changelog).