PT-2024-10850 · Motopress · The Timetable/Event Schedule By Motopress

Ram + 1 · Published 2024-10-16 · Updated 2024-10-30 · CVE-2020-36840

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Timetable and Event Schedule by MotoPress plugin for WordPress versions up to, and including, 2.3.8

Description The issue is related to a missing capability check on the wp ajax route url() function called via a nopriv AJAX action. This allows unauthenticated attackers to call the function and perform various actions, including including random templates and injecting malicious web scripts.

Recommendations For versions up to, and including, 2.3.8, update to the latest release to mitigate risks. As a temporary workaround, consider restricting access to the wp ajax route url() function until a patch is available. Additionally, ensure that all plugins are up-to-date to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-36840

Affected Products

The Timetable/Event Schedule By Motopress

References · 10

• https://osv.dev/vulnerability/CVE-2020-36840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36840 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2288592%40mp-timetable&new=2288592%40mp-timetable&sfp_email=&sfph_mail= · Patch
• https://twitter.com/CVEnew/status/1846456642340057589 · Twitter Post
• https://twitter.com/transilienceai/status/1847688351656144899 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/988d7b33-f985-4d22-a2db-3922002fcecb?source=cve · Note
• https://t.me/cvedetector/8041 · Telegram Post
• https://t.me/cvenotify/100079 · Telegram Post
• https://twitter.com/transilienceai/status/1847688345578590608 · Twitter Post
• https://twitter.com/cracbot/status/1848242906836197650 · Twitter Post