CVE-2025-12175 Overview
The Events Calendar plugin for WordPress contains a missing authorization vulnerability [CWE-862] in the tec_qr_code_modal AJAX endpoint. The flaw affects all plugin versions up to and including 6.15.9. Authenticated attackers with Subscriber-level access or higher can invoke the endpoint to view draft event names and generate or view QR codes associated with those events. The issue stems from the absence of a capability check on the AJAX handler, allowing low-privileged users to reach functionality intended for editors and administrators. Wordfence published analysis of the flaw and the vendor fixed the issue in version 6.15.10.
Critical Impact
Authenticated Subscriber-level users can enumerate draft event names and generate QR codes for unpublished events, leaking pre-release information from WordPress sites running The Events Calendar.
Affected Products
- The Events Calendar plugin for WordPress versions up to and including 6.15.9
- WordPress sites with Subscriber registration enabled and The Events Calendar installed
- Sites that use draft events for pre-release scheduling workflows
Discovery Timeline
- 2025-10-31 - CVE-2025-12175 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12175
Vulnerability Analysis
The Events Calendar exposes a tec_qr_code_modal AJAX action used by the plugin's administrative interface to render QR codes for events. In vulnerable versions the handler validates that the request originates from an authenticated user but omits a current_user_can() capability check. As a result, any authenticated role, including Subscriber, can invoke the endpoint and receive data about draft events that have not yet been published.
The returned response includes the event name and a QR code payload that references the event. Attackers can iterate event identifiers to enumerate unpublished content. While the confidentiality impact is limited to draft event metadata and generated QR codes, the flaw undermines the intended editorial workflow of the plugin. Integrity and availability are not affected because the endpoint is read-only.
Root Cause
The root cause is a missing authorization check [CWE-862] on the AJAX handler registered for tec_qr_code_modal. WordPress AJAX endpoints require explicit calls to current_user_can() or capability-mapped nonce validation to restrict access. In 6.15.9 and earlier the handler proceeds directly to the QR code generation logic once the nonce and authentication check pass, without verifying that the caller holds an editorial capability such as edit_posts or edit_tribe_events.
Attack Vector
Exploitation requires a valid WordPress account with Subscriber privileges or higher. The attacker sends a POST request to admin-ajax.php targeting the tec_qr_code_modal action along with a valid nonce and a target event identifier. The plugin responds with the draft event title and QR code data. No user interaction from a privileged user is required. On sites that allow open registration, the attack is reachable by anyone able to create an account.
See the WordPress changeset for QR Code and the upstream GitHub QR Code implementation for the corrected authorization logic.
Detection Methods for CVE-2025-12175
Indicators of Compromise
- Requests to /wp-admin/admin-ajax.php with action=tec_qr_code_modal originating from accounts that do not hold editorial roles
- Sequential or scripted enumeration of event post IDs against the tec_qr_code_modal endpoint
- New Subscriber accounts created shortly before bursts of AJAX traffic to The Events Calendar endpoints
Detection Strategies
- Review WordPress access logs for POST requests to admin-ajax.php with the tec_qr_code_modal action and correlate the user ID against role assignments
- Alert on any Subscriber or Contributor account that successfully invokes plugin AJAX actions historically reserved for editors
- Compare event IDs referenced in QR code AJAX calls against the list of published events to identify draft enumeration
Monitoring Recommendations
- Enable WordPress application logging or a plugin that records AJAX action names, user IDs, and response codes
- Forward web server logs to a centralized log store and build queries for the tec_qr_code_modal action string
- Monitor plugin version telemetry across managed WordPress fleets to identify hosts still running 6.15.9 or earlier
How to Mitigate CVE-2025-12175
Immediate Actions Required
- Upgrade The Events Calendar plugin to version 6.15.10 or later on every WordPress site in the environment
- Audit existing Subscriber and Contributor accounts and disable those that are not required for site operation
- Rotate any draft event content that attackers may have enumerated during the exposure window
Patch Information
The vendor fixed the missing capability check in The Events Calendar 6.15.10. The corrected handler enforces an appropriate capability check before returning event metadata or QR code data. Review the WordPress changeset for QR Code and the Wordfence vulnerability analysis for the applied fix and additional guidance.
Workarounds
- Disable open user registration in WordPress settings to prevent unauthenticated attackers from obtaining Subscriber accounts
- Block requests to admin-ajax.php with action=tec_qr_code_modal at a web application firewall when the request originates from non-editorial roles
- Temporarily deactivate The Events Calendar plugin on sites that cannot be upgraded and that rely on draft event confidentiality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.