CVE-2021-24583: motopress timetable_and_event_schedule Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2021-24583 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in motopress timetable_and_event_schedule. EPSS estimates a 1.62% chance of exploitation in the next 30 days, higher than 75.8% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.4.2.

Timeline

1. 20-09-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.