Executive brief
The MotoPress Timetable and Event Schedule plugin for WordPress, which is used to manage and display event schedules, contains a security flaw. This vulnerability allows logged-in users with low-level permissions (like contributors) to view private event details and draft content created by other users. This could lead to the unauthorized disclosure of sensitive internal planning or confidential event descriptions.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'action_get_event_data' function due to insufficient validation of user-supplied keys. Authenticated attackers with contributor-level access or higher can exploit this by enumerating timeslot IDs to retrieve full WP_Post objects. This includes sensitive fields such as post_content, post_excerpt, post_status, and post_author for posts that are currently in draft, pending, or private status. The flaw effectively bypasses intended access controls for 'mp-event' post types belonging to other users.
Affected products
- MotoPress Timetable and Event Schedule by MotoPress up to, and including, 2.4.16
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/mp-timetable/tags/2.4.16/classes/class-core.php
- https://plugins.trac.wordpress.org/browser/mp-timetable/tags/2.4.16/classes/class-hooks.php
- https://plugins.trac.wordpress.org/browser/mp-timetable/tags/2.4.16/classes/controllers/class-controller-events.php
- https://plugins.trac.wordpress.org/browser/mp-timetable/tags/2.4.16/classes/models/class-events.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3548166%40mp-timetable&new=3548166%40mp-timetable&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9adf94ac-30ef-4c24-afa6-04248c25bd7f?source=cve