The MotoPress Timetable and Event Schedule plugin suffers from a CWE-502 deserialization of untrusted data vulnerability (CVE-2024-39630) that permits object injection attacks. This affects versions up to 2.4.13. The vulnerability could allow an attacker with high privileges and network access to cause partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack requires high attack complexity, privileges, and no user interaction, with a scope change. No patch or official remediation has been disclosed yet.

Successful exploitation could lead to limited unauthorized disclosure, modification, or disruption of data or service within the affected plugin. The impact is rated medium, reflecting partial compromise rather than full system takeover. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the plugin to trusted administrators and monitor for unusual activity. Avoid exposing the plugin to untrusted networks or users with high privileges. Follow vendor channels for updates on patches or official mitigations.