CVE-2025-2578: Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2578?
CVE-2025-2578 is considered a medium severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2025-2578?
To fix CVE-2025-2578, update the Booking for Appointments and Events Calendar plugin to version 1.2.20 or later.
What type of vulnerability is CVE-2025-2578?
CVE-2025-2578 is a Full Path Disclosure vulnerability affecting the Amelia plugin for WordPress.
Who is affected by CVE-2025-2578?
All users of the Booking for Appointments and Events Calendar plugin versions up to and including 1.2.19 are affected by CVE-2025-2578.
Can CVE-2025-2578 be exploited remotely?
Yes, CVE-2025-2578 can be exploited remotely by unauthenticated attackers.