CVE-2025-12192: The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12192?
CVE-2025-12192 is rated as a medium severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2025-12192?
To fix CVE-2025-12192, update the Events Calendar plugin to version 6.16.0 or later.
Who is affected by CVE-2025-12192?
CVE-2025-12192 affects users of The Events Calendar plugin for WordPress versions up to and including 6.15.9.
What type of vulnerability is CVE-2025-12192?
CVE-2025-12192 is an information disclosure vulnerability that allows unauthorized access to sensitive system information.
Is authentication required to exploit CVE-2025-12192?
No, CVE-2025-12192 can be exploited by unauthenticated attackers.