CVE-2021-24584 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

CVE-2021-24584

The CVE-2021-24584 vulnerability affects the Timetable and Event Schedule WordPress plugin by MotoPress for all versions before 2.4.2. It arises from missing access control for updating a timeslot, permitting any user with the edit_posts capability (Contributor+) to update arbitrary timeslots acr...