TI-2021-06868 Aliases CVE-2021-24584 GHSA-2v92-7cf3-4vm5

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update

LOW 25CWE-352Published 2021-09-20 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.

Summary

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

Why it matters now

EPSS 0.00506 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Timetable and Event Schedule by MotoPress (Unknown): 2.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Timetable and Event Schedule by MotoPress	2.4.2 to before 2.4.2	2.4.2	Patch available	CNA

Timetable and Event Schedule by MotoPress VendorUnknown Affected 2.4.2 to before 2.4.2 Fixed in 2.4.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:motopress:timetable_and_event_schedule::::::wordpress::*	before 2.4.2	Vulnerable	MotoPress

cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:* Versions before 2.4.2 Vulnerable ·MotoPress

Remediation

Fix · CNA Timetable and Event Schedule by MotoPress (Unknown) Fixed in 2.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-09-20
Timetable and Event Schedule by MotoPress 2.4.2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06867 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot DeletionPriority LOW 23
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24584
2026-10-03 Alias added: GHSA-2v92-7cf3-4vm5

References

Exploit 1

https://wpscan.com/vulnerability/60eadf75-8298-49de-877e-ce103fc34d58

TI-2020-18975 Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization CVSS 3.1CRITICAL 9.8
TI-2021-06869 Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure CVSS 3.1MEDIUM 6.5
TI-2022-02637 MotoPress Timetable and Event Schedule Calendar cross site scripting CVSS 3.1MEDIUM 6.1
TI-2022-02636 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting CVSS 3.1MEDIUM 6.1
TI-2021-07006 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
TI-2021-06867 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences