PT-2025-47430 · WordPress · Wordpress Community Events

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-12646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions prior to 1.5.5

Description The WordPress Community Events plugin is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the dayofyear parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This could enable unauthorized access to sensitive database information. The vulnerable parameter dayofyear is used in the existing SQL query without sufficient escaping.

Recommendations Update the WordPress Community Events plugin to version 1.5.5 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-12646

Affected Products

Wordpress Community Events

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12646 · Security Note
• https://plugins.trac.wordpress.org/changeset/3396731/community-events/trunk/community-events.php · Note
• https://t.me/cveNotify/143305 · Telegram Post
• https://twitter.com/CVEnew/status/1991042914932105640 · Twitter Post
• https://twitter.com/RedPacketSec/status/1991092656559026431 · Twitter Post
• https://twitter.com/cracbot/status/1992911114439708833 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/579b6eb0-dbb7-4586-aecc-f295889a2b2b?source=cve · Note
• https://t.me/CVEtracker/37713 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991074167819518410 · Twitter Post