The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
References
Configurations
No configuration.
History
09 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 |
03 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 2.7 |
03 Dec 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-03 06:15
Updated : 2026-01-09 21:16
NVD link : CVE-2025-12954
Mitre link : CVE-2025-12954
CVE.ORG link : CVE-2025-12954
JSON object : View
Products Affected
No product.
CWE
CWE-639
Authorization Bypass Through User-Controlled Key