PT-2025-47430 · WordPress · Wordpress Community Events

CVE-2025-12646 · Publicado 2025-11-19 · Atualizado 2025-11-24

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions prior to 1.5.5

Description The WordPress Community Events plugin is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the dayofyear parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This could enable unauthorized access to sensitive database information. The vulnerable parameter dayofyear is used in the existing SQL query without sufficient escaping.

Recommendations Update the WordPress Community Events plugin to version 1.5.5 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-12646

Produtos afetados

Wordpress Community Events

Referências · 9

• https://plugins.trac.wordpress.org/changeset/3396731/community-events/trunk/community-events.php · Nota
• https://t.me/cveNotify/143305 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1991042914932105640 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/1991092656559026431 · Publicação no Twitter
• https://twitter.com/cracbot/status/1992911114439708833 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-12646 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/579b6eb0-dbb7-4586-aecc-f295889a2b2b?source=cve · Nota
• https://t.me/CVEtracker/37713 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1991074167819518410 · Publicação no Twitter