CVE-2025-12498 Overview
CVE-2025-12498 affects the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The plugin lacks a capability check on the booking_add_notes function in all versions up to and including 4.2.0.0. Authenticated users with Subscriber-level access or higher can add notes to the backend view of any booking record. The issue is classified as Missing Authorization [CWE-862]. The vulnerability received a CVSS score of 4.3 and impacts integrity of booking data across affected WordPress sites running the plugin.
Critical Impact
Any authenticated WordPress user with Subscriber privileges or higher can inject arbitrary notes into any booking record, potentially enabling social engineering, misinformation, or disruption of event administration workflows.
Affected Products
- EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress
- All plugin versions up to and including 4.2.0.0
- WordPress installations exposing subscriber-level registration
Discovery Timeline
- 2025-11-08 - CVE-2025-12498 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12498
Vulnerability Analysis
The flaw resides in the booking_add_notes AJAX handler defined in includes/class-ep-ajax.php at line 638. The function accepts note content and a booking identifier from an authenticated request, then persists the note against the specified booking. The handler validates that the requester is logged in but does not verify whether the user holds the administrative capability required to manage bookings.
Because WordPress treats Subscriber as the lowest authenticated role, any registered user, including self-registered accounts on sites with open registration, can invoke the endpoint. An attacker crafts an AJAX POST request to the plugin's endpoint with a target booking ID and note payload. The server processes the request and writes the note to the booking record visible to administrators.
The issue affects data integrity rather than confidentiality or availability. Attackers cannot read existing bookings through this flaw, but they can pollute the administrative view with attacker-controlled content that staff may treat as legitimate booking annotations.
Root Cause
The root cause is a missing current_user_can() capability check inside the booking_add_notes function. The plugin relies solely on WordPress nonce validation and authentication state, neither of which enforces the role or capability required for booking management. This pattern is a common Broken Access Control failure classified under CWE-862 Missing Authorization.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session at Subscriber level or above. No user interaction from an administrator is needed. The attacker sends a single AJAX request referencing an arbitrary booking_id and the note text to store. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the technical breakdown.
Refer to the vendor patch in the WordPress Plugin Changeset Update for the corrective code path.
Detection Methods for CVE-2025-12498
Indicators of Compromise
- Unexpected note entries appearing on booking records that administrators did not author
- POST requests to admin-ajax.php with the action=booking_add_notes parameter originating from low-privilege user sessions
- Subscriber accounts generating repeated AJAX traffic to booking-related endpoints
- New self-registered user accounts immediately followed by booking note write activity
Detection Strategies
- Enable WordPress audit logging to capture AJAX actions and correlate the action parameter with the requesting user role
- Alert on invocations of booking_add_notes from users whose role is not Administrator, Editor, or Shop Manager
- Review web server access logs for POST requests to /wp-admin/admin-ajax.php referencing booking identifiers the requester does not own
Monitoring Recommendations
- Monitor plugin version inventory across WordPress fleets and flag installations running EventPrime 4.2.0.0 or earlier
- Track spikes in booking note creation volume against baseline administrative activity
- Ingest WordPress access logs into a centralized platform and correlate AJAX endpoints with user role metadata
How to Mitigate CVE-2025-12498
Immediate Actions Required
- Update the EventPrime – Events Calendar, Bookings and Tickets plugin to the version released after changeset 3389496
- Audit existing booking records for unexpected notes and remove attacker-supplied content
- Review the WordPress user list and remove unrecognized Subscriber-level accounts created recently
- Disable open user registration where it is not required for business operations
Patch Information
The vendor addressed the missing capability check in the plugin update tracked by WordPress Plugin Changeset 3389496. Administrators should upgrade to a version higher than 4.2.0.0. Confirm the installed version through the WordPress plugins dashboard after applying the update.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall to block the booking_add_notes action for non-administrative roles
- Temporarily deactivate the EventPrime plugin on sites that cannot patch immediately
- Set the WordPress users_can_register option to false to prevent unauthenticated attackers from acquiring Subscriber accounts
# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
wp plugin update eventprime-event-calendar-management
wp plugin list --name=eventprime-event-calendar-management --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.