Timetable and Event Schedule by MotoPress Security & Risk Analysis

The "mp-timetable" v2.4.16 plugin exhibits a mixed security posture. While it demonstrates good practices in several areas, such as the high percentage of prepared SQL statements and properly escaped output, critical vulnerabilities remain a concern. The presence of "unserialize" calls is a significant red flag, as it can lead to "Deserialization of Untrusted Data" vulnerabilities if not handled with extreme care and robust validation. The attack surface includes two unprotected AJAX handlers, which, combined with the "unserialize" function, could be exploited for remote code execution or data manipulation. The plugin's vulnerability history is particularly concerning, with 8 known CVEs, including a past critical "Deserialization of Untrusted Data" vulnerability and others related to authorization bypass and SQL injection. The fact that all past critical and high vulnerabilities are now patched is a positive sign, but the sheer number and types of past vulnerabilities suggest a pattern of security weaknesses that require ongoing vigilance. The lack of critical taint flows in the static analysis is encouraging, but the potential for exploitation through the identified unprotected entry points and dangerous functions cannot be ignored.