CVE-2025-5733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5733", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-05T15:04:36.173Z", "datePublished": "2025-06-06T03:41:23.431Z", "dateUpdated": "2026-04-08T17:29:47.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:47.838Z"}, "affected": [{"vendor": "webnus/", "product": "Modern Events Calendar Lite", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.21.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}], "title": "Modern Events Calendar <= 7.21.9 - Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e545b53e-7054-41dc-b69b-7552ef6c3240?source=cve"}, {"url": "https://wordpress.org/plugins/modern-events-calendar-lite/"}, {"url": "https://webnus.net/dox/modern-events-calendar/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "cweId": "CWE-201", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abdullah Shittu"}], "timeline": [{"time": "2025-06-05T15:05:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-06T15:44:12.920566Z", "id": "CVE-2025-5733", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T16:10:10.183Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-06T15:44:12.920566Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T15:44:14.809Z"}}], "cna": {"title": "Modern Events Calendar <= 7.21.9 - Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Abdullah Shittu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "webnus/", "product": "Modern Events Calendar Lite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.21.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-05T15:05:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e545b53e-7054-41dc-b69b-7552ef6c3240?source=cve"}, {"url": "https://wordpress.org/plugins/modern-events-calendar-lite/"}, {"url": "https://webnus.net/dox/modern-events-calendar/"}], "descriptions": [{"lang": "en", "value": "The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:47.838Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5733", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:47.838Z", "dateReserved": "2025-06-05T15:04:36.173Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-06T03:41:23.431Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Modern Events Calendar Lite", "vendor": "webnus/", "versions": [{"lessThanOrEqual": "7.21.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}, {"lang": "es", "value": "El complemento Modern Events Calendar Lite para WordPress es vulnerable a la divulgaci\u00f3n de ruta completa en todas las versiones hasta la 7.21.9 incluida. Esto se debe a una validaci\u00f3n incorrecta o insuficiente de la propiedad id al exportar calendarios. Esto permite que atacantes no autenticados obtengan la ruta completa de la aplicaci\u00f3n web, lo que puede utilizarse para otros ataques. La informaci\u00f3n mostrada no es \u00fatil por s\u00ed sola y requiere otra vulnerabilidad para que se produzcan da\u00f1os en el sitio web afectado."}], "id": "CVE-2025-5733", "lastModified": "2026-06-17T09:48:39.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5733", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-06T15:44:12.920566Z", "version": "2.0.3"}}]}, "published": "2025-06-06T04:16:01.840", "references": [{"source": "security@wordfence.com", "url": "https://webnus.net/dox/modern-events-calendar/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/modern-events-calendar-lite/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e545b53e-7054-41dc-b69b-7552ef6c3240?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T07:38:43.071087+00:00", "value": {"mitigation_remediation": ["Upgrade the Modern Events Calendar Lite plugin to the latest version (above 7.21.9) to fix the CWE-201 information exposure flaw.", "Restrict the calendar export functionality to authenticated administrators only to mitigate the CWE-201 vulnerability until a patch is applied.", "If a patch or configuration change cannot be applied immediately, disable the calendar export endpoint to prevent path disclosure caused by the CWE-201 flaw."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Modern Events Calendar Lite plugin distributed by webnus that are version 7.21.9 or earlier. These versions are available to WordPress sites that use the plugin.", "description_and_impact": "The Modern Events Calendar Lite plugin for WordPress contains a full path disclosure flaw that is triggered during the export of a calendar. This occurs because the plugin does not properly validate the id parameter. The weakness is classified as CWE-201 (Information Exposure) due to insufficient validation of the ID parameter when exporting calendars. An unauthenticated attacker can trigger the export endpoint and obtain the absolute file system path of the WordPress installation. The disclosed data alone is not immediately sensitive but can facilitate reconnaissance or the planning of further attacks.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the path disclosure can be obtained without authentication, an attacker can easily obtain the information, but this alone does not enable a direct compromise. It may, however, aid subsequent attacks if another vulnerability is present."}}}}, "created": "2025-06-24T09:51:41.234485+00:00", "updated": "2026-04-22T07:45:11.742663+00:00", "vendors": ["webnus", "webnus$PRODUCT$modern_events_calendar_lite"]}