CVE-2025-12408
Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
12 dic 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
netweblogic · Events Manager – Calendar, Bookings, Tickets, and more!¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →