{"id":"CVE-2025-12954","aliases":["EUVD-2025-200729","GHSA-c799-m99w-mpg7"],"status":"published","title":"Timetable and Event Schedule by MotoPress \u003c 2.4.16 - Contributor+ Event Disclosure via IDOR","description":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00221,"percentile":0.12845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2025-12-03T06:00:05Z","modified":"2026-10-18T18:10:00Z","products":[{"vendor":"unknown","product":"timetable and event schedule by motopress"}],"references":[{"url":"https://wpscan.com/vulnerability/f15dd1ca-aa40-4d3b-9625-e3ace744374d/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12954"},{"url":"https://wpscan.com/vulnerability/f15dd1ca-aa40-4d3b-9625-e3ace744374d"},{"url":"https://github.com/advisories/GHSA-c799-m99w-mpg7"}],"sources":{"cve":[{"id":"CVE-2025-12954","title":"Timetable and Event Schedule by MotoPress \u003c 2.4.16 - Contributor+ Event Disclosure via IDOR","description":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.","status":"published","published":"2025-12-03T06:00:05.63Z","modified":"2026-01-09T20:09:23.349Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-200729","description":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.","status":"published","published":"2025-12-03T06:00:05Z","modified":"2026-01-09T20:09:23Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:48:53.623536Z"}],"ghsa":[{"id":"GHSA-c799-m99w-mpg7","title":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a...","description":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.","status":"published","published":"2025-12-03T06:31:16Z","modified":"2026-01-09T21:32:36Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2025-12954","description":"The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.","status":"published","published":"2025-12-03T06:15:47.26Z","modified":"2026-10-18T18:10:00.1Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:11:47.746175Z"}]}}