CVE-2025-12408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12408", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T15:15:50.054Z", "datePublished": "2025-12-12T11:15:50.794Z", "dateUpdated": "2026-04-08T17:04:23.934Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:23.934Z"}, "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.2.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to."}], "title": "Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392395/events-manager/trunk/em-actions.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "thinnawarth mathuros"}], "timeline": [{"time": "2025-10-28T15:31:36.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-11T21:39:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T15:31:10.390962Z", "id": "CVE-2025-12408", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T15:31:14.953Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T15:31:10.390962Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T14:39:05.078Z"}}], "cna": {"title": "Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "thinnawarth mathuros"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "7.2.2.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-28T15:31:36.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-11T21:39:32.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392395/events-manager/trunk/em-actions.php"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-12T11:15:50.794Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12408", "state": "PUBLISHED", "dateUpdated": "2025-12-12T15:31:14.953Z", "dateReserved": "2025-10-28T15:15:50.054Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T11:15:50.794Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "vendor": "netweblogic", "versions": [{"lessThanOrEqual": "7.2.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to."}, {"lang": "es", "value": "El plugin Events Manager - Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta la, y incluyendo, 7.2.2.2 a trav\u00e9s de la acci\u00f3n 'get_location' debido a restricciones insuficientes sobre qu\u00e9 ubicaciones pueden ser incluidas. Esto hace posible que atacantes no autenticados extraigan datos de ubicaciones de eventos protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-12408", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12408", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T15:31:10.390962Z", "version": "2.0.3"}}]}, "published": "2025-12-12T12:15:45.587", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3392395/events-manager/trunk/em-actions.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:47:35.731934+00:00", "value": {"mitigation_remediation": ["Update the Events Manager plugin to the latest available release, which removes the insufficient restrictions on the 'get_location' action.", "If an immediate update is not feasible, temporarily disable the 'get_location' endpoint or enforce role\u2011based access rules that block unauthenticated requests from that action.", "Configure the web server or WordPress to block unauthenticated requests to the get_location action, for example by using .htaccess rules or server\u2011side access controls to restrict the endpoint to authenticated users only."], "summary": {"action": "Patch Immediately", "impact": "Information Exposure"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Events Manager plugin by netweblogic, including all releases up to and including 7.2.2.2.", "description_and_impact": "The Events Manager plugin for WordPress contains an information exposure flaw that allows unauthenticated users to retrieve sensitive data from event locations marked as password protected, private, or draft. The flaw arises because the plugin\u2019s 'get_location' action does not enforce proper access controls on which locations can be returned. The weakness is classified as CWE-200, exposing confidential event data to anyone with website access.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3, indicating moderate severity. Its EPSS score is below 1%, suggesting low but non-zero probability of exploitation, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending requests to the get_location action without authentication to fetch data from protected locations. Because no additional authentication or privilege checks exist, the exposure is purely informational and does not directly lead to code execution or DoS."}}}}, "created": "2025-12-14T21:16:28.734927+00:00", "updated": "2026-04-22T13:00:09.726872+00:00", "vendors": ["netweblogic", "netweblogic$PRODUCT$events_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}