CVE-2025-12192

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions through 6.15.9

Description The Events Calendar plugin for WordPress has an information disclosure issue. The sysinfo REST endpoint performs a weak comparison between the provided key and the stored opt-in key. This allows unauthenticated attackers to obtain the full system report when the "Yes, automatically share my system information with The Events Calendar support team" setting is enabled. The vulnerable endpoint is /sysinfo. The issue arises from the comparison of the key parameter.

Recommendations Versions prior to 6.15.9 are affected.