CVE-2020-36840CWE-862

Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization

High · published October 16, 2024

CVSS v3.1
7.3
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-10-16T07:31Z
EPSS history
Timeline
  • 16 OCT 07:31Z
    Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
    cvelistv5