CVE-2020-36840 — Missing Authorization in Timetable AND Event Schedule

CWE-862 — Missing Authorization3 documents3 sources
Severity
9.8CRITICALNVD
CNA7.3
EPSS
0.4%
top 41.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Motopress Timetable AND Event ScheduleJetmonsters Timetable AND Event Schedule BY Motopress
Timeline
PublishedOct 16

Description

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-g4vp-6m74-35jg: The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_a↗2024-10-16
▶
CVEList
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization↗2024-10-16
▶
CVE-2020-36840 — Missing Authorization | cvebase