CVE-2024-39630 MEDIUM

CVE-2024-39630: WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability

Vendor Motopress
Product Timetable and Event Schedule
Weakness CWE-502 · Unsafe deserialization
Published August 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.

Explanation of Vulnerability in Simple Terms

02Summary

MotoPress Timetable and Event Schedule versions up to 2.4.13 contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator with high privileges can craft malicious serialized input to trigger unintended code execution or data manipulation. The vulnerability requires specific attack conditions and affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code or manipulate site data by submitting malicious serialized input.

Potential impact on your site

04Site Impact

A compromised admin account could execute code or corrupt data; limit admin access to trusted users only.

Conditions required to exploit

05Prerequisites

Attacker must be authenticated as a high-privilege administrator; attack requires specific conditions to succeed.

Key dates

06Disclosure timeline

August 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49109 WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-32511 WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability CVE-2026-39555 WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability CVE-2026-39471 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection