CVE-2025-12526: WordPress Private Google Calendars Plugin Flaw

CVE-2025-12526 Overview

CVE-2025-12526 affects the Private Google Calendars plugin for WordPress through version 20250811. The plugin exposes the pgc_remove action without a capability check, allowing authenticated users with Subscriber-level access or higher to reset plugin settings. The flaw is classified under CWE-862: Missing Authorization. It affects data integrity rather than confidentiality or availability of the WordPress host.

Critical Impact
Any logged-in WordPress user, including low-privilege Subscriber accounts, can trigger the pgc_remove action to wipe the plugin configuration and disrupt calendar functionality on the site.

Affected Products

Private Google Calendars plugin for WordPress — all versions up to and including 20250811
WordPress sites with open user registration are at higher risk due to easy Subscriber account creation
Any WordPress deployment running the vulnerable plugin alongside authenticated users

Discovery Timeline

2025-11-11 - CVE-2025-12526 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-12526

Vulnerability Analysis

The Private Google Calendars plugin registers a pgc_remove action handler that executes without verifying the caller's WordPress capabilities. WordPress exposes admin-ajax.php endpoints to any authenticated session, so handlers must call current_user_can() or an equivalent permission check before performing privileged operations. The plugin omits this check, which permits Subscriber-level accounts to invoke the reset routine.

Triggering the handler clears the plugin's stored settings. The site owner must reconfigure the Google Calendar integration to restore functionality. Because the action modifies configuration state rather than site content, confidentiality is not impacted, but integrity of the plugin's configuration is directly affected.

Subscriber accounts are frequently automatically created on sites with open registration, which lowers the barrier to exploitation. The CVSS vector reflects low-privilege, network-accessible exploitation with no user interaction required.

Root Cause

The root cause is a missing authorization check [CWE-862] on the pgc_remove action handler. The handler was registered for authenticated users but did not restrict execution to administrators or users with the manage_options capability.

Attack Vector

An attacker authenticates to the target WordPress site as a Subscriber, then issues an HTTP POST request to admin-ajax.php with action=pgc_remove. The server executes the reset routine and returns a successful response. No nonce bypass or additional interaction is required beyond holding a valid WordPress session cookie.

For technical details, review the Wordfence Vulnerability Report and the WordPress Plugins Change Log for the committed fix.

Detection Methods for CVE-2025-12526

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the parameter action=pgc_remove from non-administrative user sessions
Unexpected resets of Private Google Calendars plugin settings observed in the WordPress admin dashboard
Calendar widgets failing to render or displaying authentication prompts after a settings reset event

Detection Strategies

Enable WordPress audit logging to record the originating user, IP address, and action name for every admin-ajax.php request
Alert on any invocation of action=pgc_remove by accounts that do not hold the Administrator role
Review the plugin's option values on a schedule and flag unexpected zero or default states as potential tampering

Monitoring Recommendations

Forward WordPress access logs and audit events to a centralized log store for correlation across sites
Monitor newly created Subscriber accounts, particularly on sites with open registration, and correlate them with subsequent AJAX activity
Track plugin configuration changes using file integrity monitoring on the wp_options table

How to Mitigate CVE-2025-12526

Immediate Actions Required

Update the Private Google Calendars plugin to a version released after 20250811 that includes the capability check fix
Audit WordPress user accounts and remove unused Subscriber-level accounts
Disable open user registration if it is not required for site operation

Patch Information

The vendor committed a fix referenced in the WordPress Plugins Change Log. Site administrators should install the latest release from the Private Google Calendars Plugin page through the WordPress plugin updater.

Workarounds

Deactivate the Private Google Calendars plugin until the patched version is installed
Deploy a web application firewall rule that blocks action=pgc_remove requests from users without the Administrator role
Restrict access to /wp-admin/admin-ajax.php from unauthenticated or low-trust networks where business requirements allow

bash

# Example ModSecurity rule to block the vulnerable action for non-admin sessions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1012526,phase:2,deny,status:403,msg:'Block CVE-2025-12526 pgc_remove'"
    SecRule ARGS:action "@streq pgc_remove" \
        "chain"
        SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "!@rx ^admin" "t:none"