CVE-2020-36840

The Timetable and Event Schedule by MotoPress plugin through version 2.3.8 lacks proper permission validation in the wp_ajax_route_url() function, which is accessible to unauthenticated users through a nopriv AJAX action. This authorization flaw allows attackers without login credentials to execute the vulnerable function and perform harmful activities including arbitrary template inclusion and malicious script injection.

Based on public CVE data (MITRE/NVD).