CVE-2025-5936

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5936", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T15:35:32.522Z", "datePublished": "2025-06-27T07:22:23.312Z", "dateUpdated": "2026-04-08T16:54:29.411Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:29.411Z"}, "affected": [{"vendor": "innate-images-llc", "product": "VR Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57dbafe8-dcb3-4ac9-ad5e-76baf1963850?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vr-calendar-sync/trunk/Admin/Classes/VRCalendarAdmin.class.php#L98"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-06-26T19:04:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-27T13:42:21.723263Z", "id": "CVE-2025-5936", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-27T13:44:49.401Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-27T13:42:21.723263Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-27T13:43:19.344Z"}}], "cna": {"title": "VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "innate-images-llc", "product": "VR Calendar", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.4.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-26T19:04:46.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57dbafe8-dcb3-4ac9-ad5e-76baf1963850?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vr-calendar-sync/trunk/Admin/Classes/VRCalendarAdmin.class.php#L98"}], "descriptions": [{"lang": "en", "value": "The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-06-27T07:22:23.312Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5936", "state": "PUBLISHED", "dateUpdated": "2025-06-27T13:44:49.401Z", "dateReserved": "2025-06-09T15:35:32.522Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-27T07:22:23.312Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VR Calendar", "vendor": "innate-images-llc", "versions": [{"lessThanOrEqual": "2.4.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vr_calendar_project:vr_calendar:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "8C277DC8-CA11-4347-86A3-69A87480A332", "versionEndIncluding": "2.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento VR Calendar para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.4.7 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n syncCalendar(). Esto permite que atacantes no autenticados activen la sincronizaci\u00f3n del calendario mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-5936", "lastModified": "2026-06-17T09:49:03.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5936", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-27T13:42:21.723263Z", "version": "2.0.3"}}]}, "published": "2025-06-27T08:15:22.497", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/vr-calendar-sync/trunk/Admin/Classes/VRCalendarAdmin.class.php#L98"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57dbafe8-dcb3-4ac9-ad5e-76baf1963850?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:11:53.984871+00:00", "value": {"mitigation_remediation": ["Update the VR Calendar plugin to the latest version that includes the nonce validation fix (any release newer than 2.4.7).", "If an update is delayed, temporarily disable the syncCalendar functionality or remove the relevant admin menu items to prevent accidental invocation.", "Limit who can trigger calendar syncs by ensuring only trusted administrators have the capability to access that function, for example by checking user roles before allowing it."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Request Forgery allowing an unauthenticated attacker to trigger the plugin\u2019s calendar synchronization function on a target WordPress site"}, "threat_synthesis": {"affected_systems": "The affected product is the VR Calendar plugin, version 2.4.7 and all earlier releases, provided by Innate Images, LLC. The plugin runs within a WordPress environment and the vulnerability exists in the WordPress plugin\u2019s administration code.", "description_and_impact": "The VR Calendar plugin for WordPress contains a flaw caused by missing or incorrect nonce validation in the syncCalendar() function. An attacker who can lure a site administrator into clicking a crafted link or interacting with a forged request can cause that administrator\u2019s browser to submit a synchronous request to the plugin. The result is that the calendar sync routine runs under the administrator\u2019s credentials, potentially exposing or altering calendar data, or causing other unintended state changes within the site. This is a classic CSRF vulnerability that does not require direct authentication to execute.", "risk_and_exploitability": "The CVSS score of 4.3 reflects moderate severity, largely due to the requirement of social engineering for exploitation. The EPSS score is less than 1\u202f%, indicating a very low likelihood that the vulnerability will be actively exploited at this time, and the vulnerability has not been listed in the CISA KEV catalogue. Exploitation would typically involve deceiving an administrator into opening a malicious link that submits a forged request to the syncCalendar() endpoint, thereby triggering the sync operation without credentials."}}}}, "created": "2025-07-13T21:48:19.555105+00:00", "updated": "2026-04-22T01:15:07.313331+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}