CVE-2021-24585: fallo en Timetable and Event Schedule by MotoPress
Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 1.2%
probabilidad de explotación
1.2%top 33% de las CVE
explotación observada
noninguna fuente lo reporta
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
Productos afectados
Unknown · Timetable and Event Schedule by MotoPressCVEs relacionadas — Timetable and Event Schedule by MotoPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24583—Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot DeletionEPSS 1.6%CVE-2021-24724—Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-24584—Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot UpdateEPSS 0.5%CVE-2025-12954LOWTimetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOREPSS 0.2%