CVE-2020-36840

CVE-2020-36840 is a critical authorization bypass vulnerability affecting the Timetable and Event Schedule by MotoPress plugin for WordPress, specifically versions up to and including 2.3.8. This flaw allows unauthenticated attackers to invoke a specific AJAX function, enabling them to include arbitrary templates, inject malicious web scripts, and execute other unauthorized actions. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, posing a significant risk to confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.