CVE-2025-12954
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-04
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| motopress | timetable_and_event_schedule | 2.4.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Timetable and Event Schedule by MotoPress WordPress plugin versions before 2.4.16. It occurs because the plugin does not verify whether a user has access to a specific event when duplicating it. As a result, users with a role as low as Contributor can access events they should not be able to see, leading to arbitrary event disclosure.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of event information to users with low-level roles, such as Contributors. This means sensitive or private event details could be exposed to users who should not have access, potentially compromising confidentiality and privacy within the WordPress site.