CVE-2025-27360: Quick Event Calendar CSRF Vulnerability

CVE-2025-27360 Overview

CVE-2025-27360 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the WP Corner Quick Event Calendar plugin for WordPress. The flaw affects all versions of the quick-event-calendar plugin up to and including 1.4.9. An attacker can trick an authenticated user into submitting a forged request that performs unintended state-changing actions within the plugin. Exploitation requires user interaction, typically by luring a logged-in administrator to visit a malicious page. The vulnerability carries a CVSS 3.1 base score of 4.3 and impacts integrity without affecting confidentiality or availability.

Critical Impact
Attackers can perform unauthorized state-changing actions in the Quick Event Calendar plugin by tricking authenticated WordPress users into loading a crafted request.

Affected Products

WP Corner Quick Event Calendar plugin for WordPress
Versions from n/a through 1.4.9 (inclusive)
WordPress sites running the quick-event-calendar plugin

Discovery Timeline

2025-06-06 - CVE-2025-27360 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27360

Vulnerability Analysis

The vulnerability stems from missing CSRF protections in the Quick Event Calendar plugin. The plugin fails to validate anti-CSRF tokens (WordPress nonces) on sensitive request handlers. An attacker who crafts a malicious HTML page can force an authenticated WordPress user's browser to submit requests to the target site. The browser automatically attaches valid session cookies, allowing the forged request to execute with the victim's privileges. The impact is limited to integrity, meaning attackers can modify plugin data or state but cannot directly exfiltrate confidential information or crash the site.

Root Cause

The root cause is the absence of proper request origin validation on plugin action endpoints. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to prevent CSRF, but the affected versions of quick-event-calendar do not enforce these checks on state-changing operations through version 1.4.9.

Attack Vector

The attack requires network access and user interaction. An attacker hosts a malicious page containing an auto-submitting form or crafted image tag pointing at a vulnerable plugin endpoint. When an authenticated WordPress user visits the page, their browser issues the forged request using their existing session, resulting in unauthorized actions on the target site.

No verified proof-of-concept code is available. Refer to the Patchstack advisory for CVE-2025-27360 for additional technical detail.

Detection Methods for CVE-2025-27360

Indicators of Compromise

Unexpected changes to Quick Event Calendar entries, settings, or plugin-managed data
WordPress access logs showing plugin action requests with Referer headers pointing to external or unfamiliar domains
Plugin activity performed under an administrator account during time windows when no admin was actively working in wp-admin

Detection Strategies

Inspect web server logs for POST or GET requests to Quick Event Calendar endpoints that lack a matching _wpnonce parameter
Correlate authenticated admin session activity with off-site referers to identify possible CSRF-triggered actions
Deploy a web application firewall rule that flags cross-origin requests to WordPress plugin endpoints without valid nonces

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration and content changes with user, IP, and referer attribution
Alert on administrator actions originating from unusual referers or immediately following external navigation events
Review installed plugin inventory to identify sites running quick-event-calendar version 1.4.9 or earlier

How to Mitigate CVE-2025-27360

Immediate Actions Required

Identify all WordPress sites running the Quick Event Calendar plugin and confirm installed version
Update the plugin to a fixed version once released by WP Corner, or deactivate and remove it if no patched version is available
Instruct administrators to log out of WordPress sessions before browsing untrusted sites

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack lists all versions through 1.4.9 as affected. Monitor the Patchstack advisory and the plugin's WordPress.org page for a patched release above 1.4.9. Apply updates through the standard WordPress plugin update workflow.

Workarounds

Deactivate the quick-event-calendar plugin until a patched version is available
Deploy a WAF rule requiring a same-origin Referer or Origin header on requests to plugin endpoints
Restrict wp-admin access to trusted IP ranges to reduce the pool of users exposed to CSRF payloads
Require administrators to use separate browsers or browser profiles for WordPress administration and general browsing

bash

# Example nginx snippet enforcing same-origin requests to wp-admin
location ~ ^/wp-admin/ {
    if ($http_origin !~* ^https?://(www\.)?example\.com$) {
        return 403;
    }
    # ... existing PHP handler configuration
}