MotoPress Timetable CVE-2026-9228

Exploitation requires a valid WordPress user account with at minimum contributor-level privileges on the target site - anonymous or subscriber-level access is insufficient. The target site must have the Timetable and Event Schedule by MotoPress plugin installed, active, and running version 2.4.16 or earlier. For meaningful data exposure, the site must also have draft, pending, or private mp-event posts created by other users, as the vulnerability only exposes non-public content that would otherwise be access-restricted. The CVSS vector PR:L confirms the authenticated requirement. What limits exploitation is the contributor-role prerequisite (a non-trivial barrier on tightly managed sites), the narrow data exposure (event post metadata only, no credentials or system access), and the unchanged scope (S:U, no lateral movement beyond the WordPress data layer).

The CVSS 3.1 base score of 4.3 (Medium) reflects a constrained impact profile: AV:N (network-exploitable), AC:L (low complexity), PR:L (requires authenticated low-privilege account), UI:N (no victim interaction needed), S:U (no scope change), and C:L/I:N/A:N (partial confidentiality loss only). Real-world risk is moderate-to-low for most deployments. The requirement for at least contributor-level WordPress access substantially limits the attacker pool - this is not an unauthenticated or subscriber-level issue. The confidentiality impact is limited to metadata and content of non-public event posts, not credentials, session tokens, or system-level data. No EPSS data was provided in the intelligence package, and this CVE does not appear in the CISA KEV catalog, meaning no confirmed active exploitation is known. No public exploit code or POC has been identified. The primary real-world concern is insider threat or compromised contributor accounts on multi-author WordPress sites that publish sensitive event drafts.

An attacker with a valid contributor account on a target WordPress site sends a series of crafted AJAX POST requests to the site's admin-ajax.php endpoint, calling action_get_event_data with incrementing or guessed timeslot ID values. Because the plugin performs no authorization check on the requested ID, each valid ID returns the full WP_Post object - including draft or private event content authored by editors, administrators, or other users - which the attacker aggregates to exfiltrate unpublished event details, author identities, and confidential scheduling information.