CVE-2026-9228

Name of the Vulnerable Software and Affected Versions Timetable and Event Schedule by MotoPress versions prior to 2.4.17

Description An Insecure Direct Object Reference exists in the action get event data function due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access or higher can enumerate timeslot IDs to read the full WP Post object of draft, pending, and private mp-event posts belonging to other users. This includes access to post content, post excerpt, post status, and post author, as well as associated raw timeslot descriptions.

Recommendations Update Timetable and Event Schedule by MotoPress to version 2.4.17 or later.