What is the CVSS score of CVE-2026-9228?

CVE-2026-9228 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

MotoPress Timetable CVE-2026-9228

EUVD-2026-32705 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-28 Wordfence

GHSA-gcrv-h884-8q69

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 05:02 vuln.today

CVE Published

May 28, 2026 - 03:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.16 via the action_get_event_data due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate timeslot IDs and read the full WP_Post object - including post_content, post_excerpt, post_status, and post_author - of draft, pending, and private mp-event posts belonging to other users, along with their associated raw timeslot descriptions.

AnalysisAI

Insecure Direct Object Reference in the Timetable and Event Schedule by MotoPress WordPress plugin (all versions through 2.4.16) allows authenticated contributors to bypass object-level authorization and read non-public content belonging to other users. The vulnerability exists in the action_get_event_data AJAX action, which accepts a user-controlled timeslot key with no ownership or visibility validation, exposing full WP_Post data - including post_content, post_excerpt, post_status, and post_author - for draft, pending, and private mp-event posts. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the plugin's AJAX handler accepts an attacker-controlled identifier and retrieves the corresponding database object without verifying that the requesting user is authorized to view it. Code inspection via the WordPress Trac browser confirms the flaw spans multiple layers of the plugin: class-core.php (L311), class-controller-events.php (L62), class-events.php (L102), and class-hooks.php (L152) - indicating the missing authorization check is not isolated to a single function but reflects a design-level oversight in the plugin's event data retrieval flow. The affected product is identified by CPE cpe:2.3:a:jetmonsters:timetable_and_event_schedule_by_motopress:*:*:*:*:*:*:*:*, published by JetMonsters for the WordPress ecosystem. The vulnerability class is a classic IDOR: sequential or guessable integer IDs allow enumeration without any privileged API key or session token beyond a standard contributor account.

RemediationAI

An upstream code fix has been committed to the WordPress plugin SVN repository (changeset 3548166: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3548166%40mp-timetable&new=3548166%40mp-timetable&sfp_email=&sfph_mail=); however, the exact released patched version number is not independently confirmed from the available intelligence data - administrators should update the plugin to the latest available version via the WordPress dashboard and verify the installed version is newer than 2.4.16. As a compensating control on sites where the update cannot be immediately applied, consider restricting contributor-level role assignment to fully trusted users only, since contributor access is a hard prerequisite for exploitation. Removing the contributor role from untrusted or external users eliminates the attack surface without disabling the plugin. Monitoring AJAX requests to wp-admin/admin-ajax.php targeting action_get_event_data with anomalous or rapidly cycling post ID parameters can serve as a detection signal for enumeration attempts.