{"id":"CVE-2020-36840","aliases":["EUVD-2020-30792","GHSA-g4vp-6m74-35jg"],"status":"published","title":"Timetable and Event Schedule by MotoPress \u003c= 2.3.8 - Missing Authorization","description":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00415,"percentile":0.36108,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-10-16T07:31:50Z","modified":"2026-06-17T03:16:18Z","products":[{"vendor":"jetmonsters","product":"timetable and event schedule by motopress"},{"vendor":"motopress","product":"timetable_and_event_schedule"},{"vendor":"unknown","product":"timetable and event schedule by motopress"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988d7b33-f985-4d22-a2db-3922002fcecb?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2288592%40mp-timetable\u0026new=2288592%40mp-timetable\u0026sfp_email=\u0026sfph_mail=","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36840"},{"url":"https://github.com/advisories/GHSA-g4vp-6m74-35jg"}],"sources":{"cve":[{"id":"CVE-2020-36840","title":"Timetable and Event Schedule by MotoPress \u003c= 2.3.8 - Missing Authorization","description":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.","status":"published","published":"2024-10-16T07:31:50.702Z","modified":"2026-04-08T17:10:41.851Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-30792","description":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.","status":"published","published":"2024-10-16T07:31:50Z","modified":"2026-04-08T17:10:41Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:24:48.048938Z"}],"ghsa":[{"id":"GHSA-g4vp-6m74-35jg","title":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization...","description":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.","status":"published","published":"2024-10-16T09:30:31Z","modified":"2024-10-16T09:30:38Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:58:30.925935Z"}],"nvd":[{"id":"CVE-2020-36840","description":"The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.","status":"published","published":"2024-10-16T08:15:03.71Z","modified":"2026-06-17T03:16:18.157Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:06:48.591569Z"}]}}