PT-2025-48794 · Motopress+1 · Motopress+1

Brpsd · Published 2025-12-03 · Updated 2025-12-03 · CVE-2025-12954

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Timetable and Event Schedule by MotoPress WordPress plugin versions prior to 2.4.16

Description The Timetable and Event Schedule by MotoPress WordPress plugin does not properly verify user access to specific events during the duplication process. This can lead to unauthorized disclosure of event information to users with a Contributor role or higher. The issue allows arbitrary event disclosure.

Recommendations Update the Timetable and Event Schedule by MotoPress WordPress plugin to version 2.4.16 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12954

Affected Products

Motopress

Timetable/Event Schedule

References · 6

• 🔥 https://wpscan.com/vulnerability/f15dd1ca-aa40-4d3b-9625-e3ace744374d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12954 · Security Note
• https://t.me/cveNotify/144583 · Telegram Post
• https://t.me/CVEtracker/38735 · Telegram Post
• https://twitter.com/CVEnew/status/1996103391441805710 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996154871997739441 · Twitter Post