CVE-2025-12192CWE-697

CVE-2025-12192

Medium · published November 5, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.6th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2025-11-05T15:15Z
References (2)
https://plugins.trac.wordpress.org/changeset/3386042/the-events-calendar · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f3feb7-547e-4c01-8453-a1fc207ee009?source=cve · [email protected]
EPSS history
Timeline
  • 05 NOV 09:27Z
    The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
    cvelistv5