CVE-2021-24145

This exploit leverages an arbitrary file upload vulnerability in the Modern Events Calendar Lite WordPress plugin (versions before 5.16.5) by bypassing file type checks via the 'text/csv' content-type. It uploads a PHP shell (p0wny-shell) to achieve remote code execution.

This repository contains a functional exploit for CVE-2021-24145, an arbitrary file upload vulnerability in the Modern Events Calendar Lite WordPress plugin (versions before 5.16.5). The PoC authenticates as an admin, uploads a malicious PHP shell disguised as a CSV file, and achieves remote code execution.

This Metasploit module exploits an arbitrary file upload vulnerability in the WordPress Modern Events Calendar plugin (CVE-2021-24145) by bypassing file extension checks via the `text/csv` content-type, allowing authenticated attackers to upload and execute a PHP payload.