Medium severity · published Sep 20, 2021
CVE-2021-24583
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability…
4.3
CVSS
1.6%
EPSS
No
On KEV
Description
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetable And Event Schedule · Motopress
before 2.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24583
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24583
Exploit
https://wpscan.com/vulnerability/7aec4ef4-db3b-41fb-9177-88ce9d37bca6
More from Timetable And Event Schedule
9.8
CVE-2020-36840
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
6.5
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the…
6.1
CVE-2022-2844
MotoPress Timetable and Event Schedule Calendar cross site scripting
6.1
CVE-2022-2843
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
5.5
CVE-2024-39630
WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability