CVE-2024-3342 describes an SQL Injection vulnerability in the Timetable and Event Schedule by MotoPress WordPress plugin. The issue arises from insufficient escaping and lack of proper query preparation for the 'events' attribute in the 'mp-timetable' shortcode, allowing authenticated attackers with contributor-level privileges or higher to append arbitrary SQL queries. This can be exploited to extract sensitive data from the database or alter its contents. The vulnerability affects all versions up to and including 2.4.11. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation enables attackers with contributor-level access or above to execute arbitrary SQL commands within the database context of the WordPress site. This can lead to unauthorized data disclosure, data modification, or deletion, severely compromising the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and above to trusted users only. Monitor for updates from the vendor or MotoPress regarding patches or mitigations. Avoid using the vulnerable shortcode with untrusted input.