CVE-2025-12954 Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR
Contributors can disclose arbitrary event details due to missing access checks during duplication in the MotoPress Timetable plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12954?
CVE-2025-12954 is a low-severity missing authorization vulnerability in Unknown Timetable and Event Schedule by MotoPress, published on 3 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
Weakness: CWE-639
Which versions are affected by CVE-2025-12954?
How do I fix CVE-2025-12954?
No fix has been published for CVE-2025-12954 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12954 exists.
Sources
Also known as GHSA-c799-m99w-mpg7.