CVE-2026-9228: Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.16 via the actiongeteventdata due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate timeslot IDs and read the full WPPost object — including postcontent, postexcerpt, poststatus, and postauthor — of draft, pending, and private mp-event posts belonging to other users, along with their associated raw timeslot descriptions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Timetable and Event Schedule by MotoPressto a version that resolves this vulnerability.Fixed in 2.4.16 - Compensating control
Limit contributor-level (and above) access to the WordPress environment to prevent authenticated users from exploiting action_get_event_data to enumerate timeslot IDs and read other users’ mp-event WP_Post data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9228?
The severity of CVE-2026-9228 is rated as medium with a score of 4.3.
What vulnerabilities are associated with CVE-2026-9228?
CVE-2026-9228 involves insecure direct object reference allowing authenticated attackers to access sensitive information.
How do I fix CVE-2026-9228?
To fix CVE-2026-9228, update the MotoPress Timetable and Event Schedule plugin to a version greater than 2.4.16.
Who is affected by CVE-2026-9228?
CVE-2026-9228 affects users of the MotoPress Timetable and Event Schedule plugin in WordPress versions up to and including 2.4.16.
What function is vulnerable in CVE-2026-9228?
The vulnerable function in CVE-2026-9228 is action_get_event_data.