CVE-2025-5733: WordPress Calendar Path Disclosure Flaw

CVE-2025-5733 Overview

CVE-2025-5733 is a Full Path Disclosure vulnerability in the Modern Events Calendar Lite plugin for WordPress. The flaw affects all versions up to and including 7.21.9. It stems from improper validation of the id property during calendar export operations. Unauthenticated attackers can trigger error conditions that reveal the absolute filesystem path of the WordPress installation. The disclosure is classified under [CWE-201]. On its own, the information leak does not compromise the site, but it provides reconnaissance data that supports chaining with other vulnerabilities to achieve deeper impact.

Critical Impact
Unauthenticated remote attackers can retrieve the full server path of the web application, aiding reconnaissance for follow-on attacks.

Affected Products

Modern Events Calendar Lite plugin for WordPress (all versions ≤ 7.21.9)
Vendor: Webnus
WordPress sites using the affected plugin versions

Discovery Timeline

2025-06-06 - CVE-2025-5733 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5733

Vulnerability Analysis

The vulnerability resides in the calendar export functionality of the Modern Events Calendar Lite plugin. The plugin accepts an id parameter from unauthenticated requests without performing sufficient validation. When the plugin processes a malformed or unexpected id value, PHP raises an error that includes the absolute filesystem path of the executing script.

The attack requires no authentication, no user interaction, and can be executed remotely with low complexity. The confidentiality impact is limited to low-sensitivity path information, and there is no direct impact to integrity or availability. Attackers typically use disclosed paths to target log files, configuration files, or to craft precise payloads for Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploits against other vulnerabilities.

Root Cause

The root cause is insufficient input validation of the id property in the export handler. The plugin does not sanitize or type-check the parameter before use, and WordPress error reporting settings surface PHP warnings or notices containing the full server path. This maps to [CWE-201]: Insertion of Sensitive Information Into Sent Data.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An unauthenticated attacker sends a crafted request to the calendar export endpoint containing an invalid or unexpected id value. The server responds with an error message that embeds the absolute path to the plugin file, such as /var/www/html/wp-content/plugins/modern-events-calendar-lite/. Refer to the Wordfence Vulnerability Report for technical details of the request pattern.

Detection Methods for CVE-2025-5733

Indicators of Compromise

HTTP requests to Modern Events Calendar Lite export endpoints containing malformed or unexpected id parameter values.
Web server or PHP error logs containing absolute filesystem paths referencing modern-events-calendar-lite plugin directories.
HTTP responses to unauthenticated clients containing strings such as /var/www/, /home/, or C:\inetpub\ alongside plugin file names.

Detection Strategies

Monitor HTTP access logs for anomalous query strings targeting the plugin's export functionality with non-numeric or empty id parameters.
Inspect outbound HTTP responses for PHP warnings, notices, or stack traces containing absolute paths returned to unauthenticated visitors.
Correlate path disclosure responses with subsequent reconnaissance activity, such as requests targeting the disclosed paths for LFI or file enumeration.

Monitoring Recommendations

Enable Web Application Firewall (WAF) logging for all requests to /wp-admin/admin-ajax.php and plugin AJAX endpoints related to calendar export.
Track PHP error log volume for spikes tied to the modern-events-calendar-lite plugin directory.
Alert on repeated requests from the same source IP that trigger error responses from the plugin.

How to Mitigate CVE-2025-5733

Immediate Actions Required

Update the Modern Events Calendar Lite plugin to a version later than 7.21.9 as soon as the vendor publishes a fix.
Disable PHP error display in production by setting display_errors = Off in php.ini and confirming WP_DEBUG_DISPLAY is set to false in wp-config.php.
Restrict access to the plugin's export endpoint via WAF rules if patching is not immediately possible.
Audit web server and PHP error logs for prior path disclosure events that may have been leveraged in earlier reconnaissance.

Patch Information

At the time of publication, the Wordfence Vulnerability Report identifies all versions up to and including 7.21.9 as vulnerable. Site administrators should monitor the WordPress Plugin Page and the Webnus Product Overview for updated releases and apply them promptly.

Workarounds

Disable PHP error output to unauthenticated visitors by configuring display_errors = Off and directing errors to log files only.
Deploy WAF rules that block or sanitize requests to the calendar export endpoint containing malformed id values.
Temporarily deactivate the Modern Events Calendar Lite plugin on high-value sites until an official patch is released.

bash

# Configuration example: suppress PHP path disclosure in production
# /etc/php/8.x/fpm/php.ini
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/error.log

# wp-config.php
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_DISPLAY', false );
define( 'WP_DEBUG_LOG', true );