CVE-2020-36840: Motopress Timetable And Event Schedule

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.

Affected products

• Motopress Timetable And Event Schedule: before 2.3.9 (fixed in 2.3.9)

Published 2024-10-16. Last modified 2026-06-17.