CVE-2025-9808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9808", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-01T15:49:44.923Z", "datePublished": "2025-09-16T05:25:26.060Z", "dateUpdated": "2026-04-08T16:35:38.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:38.363Z"}, "affected": [{"vendor": "stellarwp", "product": "The Events Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.15.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues."}], "title": "The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3359403/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Miguel Santareno"}], "timeline": [{"time": "2025-08-23T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-09-01T16:08:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-15T16:24:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-16T19:15:54.507316Z", "id": "CVE-2025-9808", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-16T19:16:02.937Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-16T19:15:54.507316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-16T19:15:58.027Z"}}], "cna": {"title": "The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Miguel Santareno"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "stellarwp", "product": "The Events Calendar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.15.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-23T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-09-01T16:08:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-15T16:24:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3359403/"}], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:38.363Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9808", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:38.363Z", "dateReserved": "2025-09-01T15:49:44.923Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-16T05:25:26.060Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Events Calendar", "vendor": "stellarwp", "versions": [{"lessThanOrEqual": "6.15.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues."}], "id": "CVE-2025-9808", "lastModified": "2026-06-17T10:09:48.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9808", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-16T19:15:54.507316Z", "version": "2.0.3"}}]}, "published": "2025-09-16T06:16:06.463", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3359403/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:18:54.473385+00:00", "value": {"mitigation_remediation": ["Apply the latest patch or upgrade to The Events Calendar version 6.15.3 or later.", "If an immediate upgrade is not feasible, restrict access to the plugin\u2019s REST endpoints by disabling them or enforcing authentication, for example by adding a rule to deny all GET/POST requests to /wp-json/events/ when the requester is not logged in.", "Implement a Web Application Firewall rule to block or rate\u2011limit unauthenticated requests to the affected REST paths, reducing the risk of automated exploitation."], "summary": {"action": "Patch", "impact": "Information disclosure"}, "threat_synthesis": {"affected_systems": "StellarWP\u2019s The Events Calendar plugin, versions 6.15.2 and earlier, running on WordPress sites are affected. The vulnerability is tied to the plugin\u2019s REST API component and is present in all releases up to the specified version.", "description_and_impact": "The Events Calendar plugin for WordPress is vulnerable to information exposure in versions up to and including 6.15.2 due to a flaw in the REST endpoint. The weakness, identified as CWE\u2011200, allows attackers to read data that should be protected by password protection on vendors or venues. The exposure can reveal sensitive data such as vendor identities, venue details, or other private attributes, potentially compromising confidentiality of site content.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 1% suggests a relatively low probability of exploitation but it is not zero. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Attackers can reach the flaw by sending unauthenticated requests to the plugin\u2019s REST endpoint, as the authentication check is missing in the endpoint logic. If successful, attackers could retrieve protected information without any privilege."}}}}, "created": "2025-09-17T10:05:07.914809+00:00", "updated": "2026-04-22T14:30:18.954470+00:00", "vendors": ["theeventscalendar", "theeventscalendar$PRODUCT$the_events_calendar", "wordpress", "wordpress$PRODUCT$wordpress"]}