PT-2025-45099 · WordPress · The Events Calendar

Michael Mazzolini · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-12192

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions through 6.15.9

Description The Events Calendar plugin for WordPress has an information disclosure issue. The sysinfo REST endpoint performs a weak comparison between the provided key and the stored opt-in key. This allows unauthenticated attackers to obtain the full system report when the "Yes, automatically share my system information with The Events Calendar support team" setting is enabled. The vulnerable endpoint is /sysinfo. The issue arises from the comparison of the key parameter.

Recommendations Versions prior to 6.15.9 are affected.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2025-12192

Affected Products

The Events Calendar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12192 · Security Note
• https://plugins.trac.wordpress.org/changeset/3386042/the-events-calendar · Note
• https://t.me/CVEtracker/36608 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e5f3feb7-547e-4c01-8453-a1fc207ee009?source=cve · Note
• https://t.me/cveNotify/141784 · Telegram Post