WordPress Plugin Vulnerabilities

The Events Calendar < 6.15.3 - Unauthenticated Password-Protected Information Disclosure

Description

The plugin is vulnerable to Information Exposure via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.

Affects Plugins

Plugin icon
the-events-calendar
Fixed in 6.15.3

References

CVE
CVE-2025-9808
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Miguel Santareno
Verified
No
WPVDB ID
c95b984f-a477-4fd4-88db-9225837abaaa

Timeline

Publicly Published
2025-09-15 (about 7 months ago)
Added
2025-09-15 (about 7 months ago)
Last Updated
2025-09-15 (about 7 months ago)

Other

Published
Title
Published
2025-05-07
Title
Mail Mint < 1.17.8 - Unauthenticated Sensitive Information Exposure
Published
2025-12-15
Title
Sober < 3.5.12 - Unauthenticated Information Exposure
Published
2025-01-13
Title
WebToffee WP Backup and Migration < 1.5.4 - Unauthenticated Sensitive Information Exposure
Published
2025-08-17
Title
IDonatePro <= 2.1.9 - Authenticated (Subscriber+) Information Exposure
Published
2024-08-28
Title
Popup Builder < 4.3.7 - Sensitive Information Exposure via Imported Subscribers CSV File