CVE-2025-12954 — Timetable and Event Schedule by MotoPress [mp-timetable] < 2.4.16

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2025-12954	Timetable and Event Schedule by MotoPress [mp-timetable] < 2.4.16	Authorization Bypass Through User-Controlled Key	Low 2.7	< 2.4.16	2.4.16	2025-11-12	—

CVE-2025-12954

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.15 via the 'mptt_duplicate_event' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve arbitrary event details.

Source: Wordfence

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)