CVE-2025-12192: Events Calendar WordPress Plugin Disclosure

CVE-2025-12192 Overview

CVE-2025-12192 is an information disclosure vulnerability in The Events Calendar plugin for WordPress, affecting versions up to and including 6.15.9. The plugin's sysinfo REST endpoint compares the supplied key against the stored opt-in key using a loose PHP comparison. Unauthenticated attackers can send a boolean value to bypass the key check and retrieve the full system report. Exploitation requires the site administrator to have enabled the "Yes, automatically share my system information with The Events Calendar support team" setting. The weakness is categorized under [CWE-697] Incorrect Comparison.

Critical Impact
Unauthenticated attackers can retrieve the full WordPress system report, exposing configuration details useful for follow-on attacks.

Affected Products

The Events Calendar plugin for WordPress
Versions up to and including 6.15.9
WordPress sites with the automatic system information sharing setting enabled

Discovery Timeline

2025-11-05 - CVE-2025-12192 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12192

Vulnerability Analysis

The Events Calendar plugin exposes a sysinfo REST endpoint that returns a diagnostic report describing the WordPress environment, active plugins, theme configuration, PHP settings, and database details. Access to this endpoint is gated by a shared opt-in key stored in the plugin's options. The endpoint validates the incoming request by comparing the client-supplied key to the stored key using PHP's loose equality operator (==) rather than a strict comparison (===) or a constant-time function such as hash_equals().

PHP's loose comparison treats a boolean true as equal to any non-empty string. An attacker who supplies a boolean true (for example via a JSON body or a query string interpreted as truthy) satisfies the check without knowing the actual key value. The endpoint then returns the full system information report to the unauthenticated caller. The disclosed data supports reconnaissance for targeted follow-on attacks against outdated components or misconfigured services.

Root Cause

The root cause is a type-juggling flaw in the REST authorization logic. Using == to compare a secret against user-controlled input allows attacker-controlled types to short-circuit the check. Secure comparison requires strict typing and constant-time evaluation to prevent both type juggling and timing side channels.

Attack Vector

The vulnerability is exploitable remotely over the network without authentication or user interaction. An attacker sends a crafted HTTP request to the plugin's sysinfo REST route with a boolean true supplied where the key parameter is expected. When the opt-in setting is enabled, the endpoint returns the diagnostic report. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details.

Detection Methods for CVE-2025-12192

Indicators of Compromise

Unauthenticated HTTP requests to the plugin's sysinfo REST endpoint under /wp-json/
Request bodies or query parameters containing boolean true values in the key field
Outbound responses from the WordPress site containing full system report payloads to unknown IP addresses

Detection Strategies

Inspect web server and WordPress access logs for requests targeting The Events Calendar sysinfo REST route from unauthenticated sources
Alert on anomalously large REST responses from The Events Calendar endpoints to external clients
Correlate reconnaissance patterns where sysinfo requests precede targeted probes of disclosed plugins, themes, or PHP versions

Monitoring Recommendations

Enable REST API request logging on WordPress and forward logs to a centralized analytics platform
Monitor the plugin's opt-in setting state and alert when automatic sharing is toggled on
Track the plugin version across managed WordPress sites to identify hosts still running 6.15.9 or earlier

How to Mitigate CVE-2025-12192

Immediate Actions Required

Update The Events Calendar plugin to the version released after 6.15.9 that includes the fix from WordPress Plugin Changeset 3386042
Disable the "Yes, automatically share my system information with The Events Calendar support team" setting on all sites
Review recent web server logs for prior access to the sysinfo endpoint from untrusted sources

Patch Information

The maintainers addressed the flaw in the plugin release corresponding to changeset 3386042. The fix replaces the loose comparison with a strict, type-safe comparison of the opt-in key. Site operators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Disable the automatic system information sharing setting until the patched version is installed
Restrict access to the /wp-json/ REST namespace behind a web application firewall rule that blocks unauthenticated requests to the plugin's sysinfo route
Deny requests containing boolean or non-string values in the key parameter at the WAF layer

bash

# Update the plugin using WP-CLI
wp plugin update the-events-calendar

# Verify the installed version is later than 6.15.9
wp plugin get the-events-calendar --field=version