PT-2025-33460 · WordPress · Bizcalendar Web

Muhammad Yudha · Published 2025-08-15 · Updated 2025-08-15 · CVE-2025-7650

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: BizCalendar Web plugin for WordPress versions prior to 1.1.0.51

Description: The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion via the bizcalv shortcode. Authenticated attackers with Contributor-level access and above can include and execute arbitrary files on the server, potentially allowing the execution of PHP code. This can be used to bypass access controls and obtain sensitive data.

Recommendations: Update the BizCalendar Web plugin to version 1.1.0.51 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-7650

Affected Products

Bizcalendar Web

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7650 · Security Note
• https://wordpress.org/plugins/bizcalendar-web · Note
• https://t.me/CVEtracker/30105 · Telegram Post
• https://twitter.com/CVEnew/status/1956289019501011269 · Twitter Post
• https://t.me/cveNotify/132412 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0640538c-b076-453c-a32e-f33b4e1c77ae?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1956317577686183956 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3377221%40bizcalendar-web&new=3377221%40bizcalendar-web&sfp_email=&sfph_mail= · Note