CVE-2021-24583

Name of the Vulnerable Software and Affected Versions Timetable and Event Schedule WordPress plugin versions prior to 2.4.2

Description The issue concerns a lack of proper access control and the absence of a CSRF check, allowing any user with the edit posts capability to delete arbitrary timeslots from any events. This can be exploited via CSRF against a logged-in user with such capability.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue. As a temporary workaround, consider restricting the edit posts capability to trusted users only until the update can be applied.