CVE-2024-3342

Name of the Vulnerable Software and Affected Versions The Timetable and Event Schedule by MotoPress plugin for WordPress versions up to, and including, 2.4.11

Description The issue arises from insufficient escaping on the user-supplied events attribute of the mp-timetable shortcode and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with contributor-level access and above to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

Recommendations For versions up to, and including, 2.4.11, consider disabling the mp-timetable shortcode until a patch is available to prevent exploitation. Restrict access to the events attribute of the mp-timetable shortcode to minimize the risk of SQL injection attacks. Avoid using the events attribute in the mp-timetable shortcode until the issue is resolved.