Timetable and Event Schedule by MotoPress WordPress Plugin Event Disclosure Vulnerability

A vulnerability exists in the Timetable and Event Schedule by MotoPress WordPress plugin in versions prior to 2.4.16. The issue arises because the plugin does not properly verify a user's access to specific events when duplicating them. This flaw allows users with a Contributor role to access and duplicate events they should not have permission to.

Impact

Exploitation of this vulnerability leads to unauthorized access and duplication of events by users with a Contributor role.

Reproduction

To reproduce this vulnerability, a user with a Contributor role can navigate to the WordPress admin event editor. By hovering over the 'duplicate' option for an event, the user can replace the event ID with that of another valid event. This action will result in a duplicate of the selected event being created.

Remediation

Users are advised to update the Timetable and Event Schedule by MotoPress WordPress plugin to version 2.4.16 or later.