BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-04

Assigner: WPScan

Description

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12954

Affected Vendors & Products

Vendor	Product	Version / Range
motopress	timetable_and_event_schedule	2.4.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Timetable and Event Schedule by MotoPress WordPress plugin versions before 2.4.16. It occurs because the plugin does not verify whether a user has access to a specific event when duplicating it. As a result, users with a role as low as Contributor can access events they should not be able to see, leading to arbitrary event disclosure.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of event information to users with low-level roles, such as Contributors. This means sensitive or private event details could be exposed to users who should not have access, potentially compromising confidentiality and privacy within the WordPress site.

Hi! I’m here to help you understand CVE-2025-12954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70