CVE-2021-24583

The Timetable and Event Schedule plugin prior to version 2.4.2 contains an access control vulnerability that permits users with the edit_posts capability or higher, such as contributors, to remove timeslots from any events without authorization. The plugin also fails to implement CSRF protection on the timeslot deletion function, enabling attackers to execute this action through cross-site request forgery attacks against authenticated users possessing sufficient permissions.

Based on public CVE data (MITRE/NVD).