Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

The Events Calendar plugin for WordPress discloses system info to unauthorized users

CVE-2025-12192 · published 11 months ago
Summary

The Events Calendar plugin for WordPress versions 6.15.9 and earlier may share system information with attackers. This is a concern because it allows unauthorized users to see sensitive system details. Update to the latest version of the plugin to fix this problem.

Original advisory text
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in k...
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-697Incorrect Comparison
Timeline
Published5 Nov 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-12192 · NVD
Track software like this
Free during beta