PT-2026-3571 · WordPress · The Events Calendar
CVE-2025-15043
·
Publicado
2026-01-20
·
Atualizado
2026-01-20
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
The Events Calendar plugin for WordPress versions prior to 6.15.14
Description
The Events Calendar plugin for WordPress is susceptible to unauthorized access because of a missing capability check within the
start migration, cancel migration, and revert migration functions. This allows authenticated attackers with subscriber-level access or higher to initiate, cancel, or revert the Custom Tables V1 database migration. The revert action can lead to the complete removal of custom database tables.Recommendations
Update The Events Calendar plugin to version 6.15.14 or later.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
The Events Calendar