My Calendar, 1b5d555c435278e0c5b11486f75e0e7a4556c983

CVE, Research URL: 1b5d555c435278e0c5b11486f75e0e7a4556c983
Home page URL: Security reports for My Calendar
Application: My Calendar
Published on: May 15, 2015
Research Description: My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 My Calendar <= 2.3.29 - Path Traversal to Remote Code Execution The My Calendar plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.3.29 via the 'edit_my_calendar_styles' function in the 'my-calendar-styles.php' file. This allows unauthenticated attackers to overwrite the contents of all files the vulnerable service has access to, including adding executable PHP to PHP files.
Affected versions: max 2.3.30.
Status: vulnerable