CVE-2021-24583: vulnerability in Timetable and Event Schedule by MotoPress
Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.6%
exploitation probability
1.6%top 25% of all CVEs
observed exploitation
nono source reports it
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
Affected products
Unknown · Timetable and Event Schedule by MotoPressRelated CVEs — Timetable and Event Schedule by MotoPress
In the same product, most dangerous first.
CVE-2021-24585—Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username DisclosureEPSS 1.2%CVE-2021-24724—Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-24584—Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot UpdateEPSS 0.5%CVE-2025-12954LOWTimetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOREPSS 0.2%