TI-2021-06867 Aliases CVE-2021-24583 GHSA-6vr7-vxmx-w9qg

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

LOW 23CWE-284Published 2021-09-20 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass, Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284 and CWE-352.

Summary

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability

Why it matters now

EPSS 0.0162 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Timetable and Event Schedule by MotoPress (Unknown): 2.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Timetable and Event Schedule by MotoPress	2.4.2 to before 2.4.2	2.4.2	Patch available	CNA

Timetable and Event Schedule by MotoPress VendorUnknown Affected 2.4.2 to before 2.4.2 Fixed in 2.4.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:motopress:timetable_and_event_schedule::::::wordpress::*	before 2.4.2	Vulnerable	MotoPress

cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:* Versions before 2.4.2 Vulnerable ·MotoPress

Remediation

Fix · CNA Timetable and Event Schedule by MotoPress (Unknown) Fixed in 2.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-09-20
Timetable and Event Schedule by MotoPress 2.4.2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06868 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot UpdatePriority LOW 25
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24583
2026-10-03 Alias added: GHSA-6vr7-vxmx-w9qg

References

Exploit 1

https://wpscan.com/vulnerability/7aec4ef4-db3b-41fb-9177-88ce9d37bca6

TI-2020-18975 Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization CVSS 3.1CRITICAL 9.8
TI-2021-06869 Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure CVSS 3.1MEDIUM 6.5
TI-2022-02637 MotoPress Timetable and Event Schedule Calendar cross site scripting CVSS 3.1MEDIUM 6.1
TI-2022-02636 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting CVSS 3.1MEDIUM 6.1
TI-2021-07006 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
TI-2021-06868 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences