CVE-2021-24583CWE-284

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

published September 20, 2021

CVSS
—
EPSS
2%
Percentile
75.9
In the wild
Unconfirmed
What it is

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01620 · 75.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-09-20T10:06Z
EPSS history
Timeline
  • 20 SEP 10:06Z
    Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion
    cvelistv5