CVE-2025-12175CWE-862broken-access-control

CVE-2025-12175

Medium · published October 31, 2025

CVSS v3.1

4.3

EPSS

Percentile

14.1

In the wild

Unconfirmed

What it is

The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate/view QR codes for them.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00239 · 14.1th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-10-31T13:15Z

References (3)

https://github.com/the-events-calendar/the-events-calendar/blob/main/src/Events/QR/QR_Code.php · [email protected]https://plugins.trac.wordpress.org/changeset/3386042/the-events-calendar/tags/6.15.10/src/Events/QR/QR_Code.php · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/ab844a05-80e0-42c7-981c-dea3a18cf4d5?source=cve · [email protected]

EPSS history

Timeline

31 OCT 08:25Z
The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
cvelistv5