PT-2025-50859 · WordPress · Upcoming For Calendly

Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-14160

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Upcoming for Calendly versions through 1.2.4

Description The Upcoming for Calendly plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to the absence of nonce validation on the settings update functionality. This allows unauthenticated attackers to modify the plugin's Calendly API key by crafting a forged request, provided they can deceive a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update Upcoming for Calendly to a version newer than 1.2.4.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14160

Affected Products

Upcoming For Calendly

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14160 · Security Note
• https://plugins.trac.wordpress.org/changeset/3415892 · Note
• https://wordpress.org/plugins/upcoming-for-calendly/#developers · Note
• https://plugins.trac.wordpress.org/browser/upcoming-for-calendly/tags/1.2.4/includes/settings.php#L33 · Note
• https://plugins.trac.wordpress.org/browser/upcoming-for-calendly/trunk/includes/settings.php#L33 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d66d6f36-ad16-40ba-b32f-f4aff6f8b494?source=cve · Note
• https://t.me/CVEtracker/39558 · Telegram Post