CVE-2025-8091 Overview
CVE-2025-8091 is an information exposure vulnerability affecting the EventON Lite plugin for WordPress in all versions up to and including 2.4.6. The flaw resides in the add_single_eventon and add_eventon shortcodes, which fail to enforce sufficient restrictions on which posts can be included in rendered output. Authenticated attackers with minimal privileges can abuse these shortcodes to extract content from password-protected, private, or draft posts they should not access. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Attackers with low-privilege accounts can read content from password-protected, private, and draft WordPress posts, bypassing the platform's built-in visibility controls.
Affected Products
- WordPress EventON Lite plugin versions ≤ 2.4.6
- WordPress sites using the add_single_eventon shortcode
- WordPress sites using the add_eventon shortcode
Discovery Timeline
- 2025-08-15 - CVE-2025-8091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8091
Vulnerability Analysis
The EventON Lite plugin registers two shortcodes, add_single_eventon and add_eventon, that accept post identifiers as parameters and render the corresponding event content. The shortcode handlers query and display post data without validating whether the calling user has permission to view the referenced post. WordPress normally restricts visibility of private, draft, and password-protected posts through core capability checks. Because the plugin bypasses those checks, protected content is rendered directly into the shortcode output. An attacker only needs the ability to place a shortcode on a page or use an entry point that accepts shortcode input.
Root Cause
The root cause is missing authorization enforcement in the shortcode logic. The handlers in class-evo-shortcodes.php and downstream code in class-event.php and class-calendar_generator.php retrieve post objects by ID and expose their fields without calling capability checks such as current_user_can( 'read_post', $post_id ) or filtering by post_status. Password-protected posts are also served without requiring the reader to submit the post password. Fix details are available in Changeset #3345262.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker leverages an interface that renders shortcodes and supplies the numeric ID of a private, draft, or password-protected post. The plugin returns the post's event data in the response, disclosing information the account should not see. Public technical details are documented in the Wordfence Vulnerability Report.
No verified exploitation code is available. See the referenced EventON Lite shortcode source for the vulnerable handler logic.
Detection Methods for CVE-2025-8091
Indicators of Compromise
- Unexpected HTTP requests containing add_single_eventon or add_eventon shortcode parameters targeting numeric post IDs.
- WordPress access logs showing repeated shortcode-rendering requests iterating through sequential post IDs.
- Rendered pages returning content that corresponds to posts with post_status values of private, draft, or password-protected.
Detection Strategies
- Inspect web server logs for POST or GET requests to shortcode-processing endpoints referencing EventON Lite shortcodes with atypical id parameters.
- Correlate rendered response bodies against the WordPress wp_posts table to identify disclosures of non-published content.
- Monitor for low-privilege subscriber or contributor accounts submitting content that embeds EventON shortcodes.
Monitoring Recommendations
- Enable WordPress audit logging plugins to track shortcode usage and post-access events per user.
- Alert on anomalous enumeration patterns against post IDs originating from a single session or IP address.
- Review installed plugin inventory and flag EventON Lite installations at or below version 2.4.6.
How to Mitigate CVE-2025-8091
Immediate Actions Required
- Update the EventON Lite plugin to a version newer than 2.4.6 that incorporates the fix from Changeset #3345262.
- Audit existing pages and posts for unauthorized use of add_single_eventon and add_eventon shortcodes.
- Rotate any secrets, credentials, or draft content that may have been disclosed through the vulnerable shortcodes.
Patch Information
The vendor addressed the issue in the EventON Lite repository through Changeset #3345262. Administrators should update to the latest release available on the EventON Lite plugin page. The patch adds authorization enforcement so that shortcodes no longer return post data the requester lacks permission to view.
Workarounds
- Deactivate and remove the EventON Lite plugin until the patched release is deployed.
- Restrict shortcode usage by limiting contributor and subscriber accounts from submitting shortcode input.
- Deploy a Web Application Firewall (WAF) rule to block requests containing the vulnerable shortcodes with numeric id parameters targeting non-public posts.
# Update EventON Lite via WP-CLI to the patched release
wp plugin update eventon-lite
# Verify the installed version is newer than 2.4.6
wp plugin get eventon-lite --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
