Vulnerability · Published Sep 20, 2021 · Assigned by WPScan

CVE-2021-24584Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update

Medium 5.4

In plain English

A medium-severity cross-site request forgery in Timetable and Event Schedule by MotoPress from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

Affected products (as reported)

Vendor	Product	Versions
Unknown	Timetable and Event Schedule by MotoPress	2.4.2 – before 2.4.2

Weakness: CWE-352, CWE-79

References

https://wpscan.com/vulnerability/60eadf75-8298-49de-877e-ce103fc34d58 x_refsource_MISC