Is CVE-2026-9228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9228 being exploited in the wild.

How severe is CVE-2026-9228?

Medium severity, with a CVSS score of 4.3, published 28 May 2026.

Which products and versions are affected?

MotoPress Timetable and Event Schedule up to, and including, 2.4.16.

Is there a fix for CVE-2026-9228?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9228 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9228?

Check whether you run MotoPress Timetable and Event Schedule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9228: MotoPress Timetable and Event Schedule IDOR in action_get_event_data

CVE-2026-9228 · Severity: medium · CVSS 4.3 · Published 2026-05-28

The MotoPress Timetable and Event Schedule plugin for WordPress, which is used to manage and display event schedules, contains a security flaw. This vulnerability allows logged-in users with low-level permissions (like contributors) to view private event details and draft content created by other users. This could lead to the unauthorized disclosure of sensitive internal planning or confidential event descriptions.

Vendors: MotoPress.

Quick answers

Is CVE-2026-9228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9228 being exploited in the wild.
How severe is CVE-2026-9228?: Medium severity, with a CVSS score of 4.3, published 28 May 2026.
Which products and versions are affected?: MotoPress Timetable and Event Schedule up to, and including, 2.4.16.
Is there a fix for CVE-2026-9228?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9228 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9228?: Check whether you run MotoPress Timetable and Event Schedule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'action_get_event_data' function due to insufficient validation of user-supplied keys. Authenticated attackers with contributor-level access or higher can exploit this by enumerating timeslot IDs to retrieve full WP_Post objects. This includes sensitive fields such as post_content, post_excerpt, post_status, and post_author for posts that are currently in draft, pending, or private status. The flaw effectively bypasses intended access controls for 'mp-event' post types belonging to other users.

Affected products

MotoPress Timetable and Event Schedule by MotoPress up to, and including, 2.4.16

Timeline

2026-05-28: disclosed
2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.