Medium severity · published Aug 1, 2024
CVE-2024-39630
WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetable and Event Schedule · MotoPress
through 2.4.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39630
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39630
patchstack.com
https://patchstack.com/database/vulnerability/mp-timetable/wordpress-timetable-and-event-schedule-by-motopress-plugin-2-4-13-php-object-injection-vulnerability?_s_id=cve
More from Timetable and Event Schedule
9.8
CVE-2020-36840
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
6.5
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the…
6.1
CVE-2022-2844
MotoPress Timetable and Event Schedule Calendar cross site scripting
6.1
CVE-2022-2843
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
5.4
CVE-2021-24584
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability…