CVE-2026-9228

Vulnerability

The Timetable and Event Schedule by MotoPress plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in the action_get_event_data AJAX handler, located in class-controller-events.php [4]. This handler calls the get_event_data method on the Events model, passing a user-supplied id parameter without verifying the ownership or publication status of the requested event [1]. The get_event_data method uses the id field to query the mp_timetable_data table and returns the associated WP_Post object, including post_content, post_excerpt, post_status, and post_author fields, for any mp-event post regardless of its visibility (draft, pending, or private). The vulnerability affects all versions up to and including 2.4.16 [1][4].

Exploitation

An attacker must be authenticated with at least contributor-level access, which grants the edit_posts capability [4]. The attacker can send a crafted POST request to admin-ajax.php with the action parameter set to action_get_event_data and a numeric id value representing a timeslot ID. Since the id parameter is validated only as an integer but not against the current user's permissions or the event's visibility, the attacker can enumerate timeslot IDs (e.g., by iterating integers or leveraging other informational endpoints) and receive the full event data for any mp-event post, including those belonging to other users. No additional privileges or user interaction is required beyond authentication [4].

Impact

Successful exploitation allows the attacker to read the complete WP_Post object of draft, pending, and private mp-event posts authored by other users. This includes the post content, excerpt, status, and author ID, as well as the associated raw timeslot descriptions. The vulnerability leads to unauthorized information disclosure of unpublished or private content, potentially exposing sensitive scheduling details or other confidential information stored within event posts [1][4].

Mitigation

As of the publication of this CVE, no patched version has been announced in the available references. The vendor is expected to release a fix in a future update (e.g., 2.4.17 or later) that adds proper authorization checks, such as verifying current_user_can('edit_post', $event_id) before returning data. Until a patch is available, site administrators should limit contributor-level access to trusted users, consider using a Web Application Firewall to block suspicious AJAX requests, and monitor the plugin's update page for a security release.