CVE-2025-12498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12498", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-29T23:16:36.772Z", "datePublished": "2025-11-08T06:39:56.156Z", "dateUpdated": "2026-04-08T17:25:30.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:30.967Z"}, "affected": [{"vendor": "metagauss", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking."}], "title": "EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L638"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389496/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Brian Mungai"}], "timeline": [{"time": "2025-11-04T05:28:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T18:19:43.284031Z", "id": "CVE-2025-12498", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T18:32:07.128Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T18:19:43.284031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T18:31:22.005Z"}}], "cna": {"title": "EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation", "credits": [{"lang": "en", "type": "finder", "value": "Brian Mungai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "metagauss", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.2.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-04T05:28:17.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L638"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389496/"}], "descriptions": [{"lang": "en", "value": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-08T06:39:56.156Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12498", "state": "PUBLISHED", "dateUpdated": "2025-11-10T18:32:07.128Z", "dateReserved": "2025-10-29T23:16:36.772Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T06:39:56.156Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EventPrime \u2013 Events Calendar, Bookings and Tickets", "vendor": "metagauss", "versions": [{"lessThanOrEqual": "4.2.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking."}, {"lang": "es", "value": "El plugin EventPrime - Events Calendar, Bookings and Tickets para WordPress es vulnerable a la creaci\u00f3n no autorizada de notas de reserva debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n 'booking_add_notes' en todas las versiones hasta la 4.2.0.0, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, a\u00f1adan una nota a la vista de backend de cualquier reserva."}], "id": "CVE-2025-12498", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T18:19:43.284031Z", "version": "2.0.3"}}]}, "published": "2025-11-08T07:15:36.387", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L638"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3389496/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:35:11.987115+00:00", "value": {"mitigation_remediation": ["Update the EventPrime plugin to a version newer than 4.2.0.0 where the capability check has been restored.", "If an immediate update is unavailable, revoke the booking_add_notes capability from the Subscriber role or otherwise restrict the ability to add booking notes to higher\u2011privileged roles only.", "Monitor the booking notes section for unexpected or anomalous entries and review access logs to detect any unauthorized activity, following up with an audit of user permissions when suspicious notes are found."], "summary": {"action": "Apply Patch", "impact": "Unauthorized booking note creation by authenticated users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the EventPrime plugin installed in any version up to and including 4.2.0.0 are affected. The vulnerability applies to all installations running those versions regardless of configuration, as the check is missing in the core booking notes functionality.", "description_and_impact": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress contains a missing capability check in the booking_add_notes function, which allows authenticated attackers with Subscriber-level access and above to add arbitrary notes to the backend view of any booking. This weakness, identified as CWE-862, enables the creation of potentially misleading or fraudulent booking entries without granting broader system compromise.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low overall severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The vulnerability can be exploited by any authenticated user with Subscriber-level or higher permissions; no additional privilege escalation is required. Based on the description, it is inferred that the attack vector is an authenticated internal user action, making it a moderate risk within an organization but unlikely to be widely abused externally."}}}}, "created": "2025-11-10T09:33:24.352947+00:00", "updated": "2026-04-21T18:45:06.076320+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$eventprime", "wordpress", "wordpress$PRODUCT$wordpress"]}