CVE-2025-12192

MEDIUM5.3

The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure

Published Nov 5, 2025

Modified 3 months ago

Details

The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.

References

WEB

https://plugins.trac.wordpress.org/changeset/3386042/the-events-calendar

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-12192

WEB

https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f3feb7-547e-4c01-8453-a1fc207ee009?source=cve

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector