{“lastseen”:””,”description”:”The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ‘tec_qr_code_modal’ AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate\/view QR codes for them.”,”published”:”2025-10-31T08:25:54.534Z”,”modified”:”2025-10-31T08:25:54.534Z”,”type”:”cve”,”title”:”The Events Calendar \\u003c= 6.15.9 – Missing Authorization to Authenticated (Subscriber+) Draft Event Title\/QR Code Exposure”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/ab844a05-80e0-42c7-981c-dea3a18cf4d5?source=cve\\nhttps:\/\/github.com\/the-events-calendar\/the-events-calendar\/blob\/main\/src\/Events\/QR\/QR_Code.php\\nhttps:\/\/plugins.trac.wordpress.org\/changeset\/3386042\/the-events-calendar\/tags\/6.15.10\/src\/Events\/QR\/QR_Code.php”,”id”:”CVE-2025-12175″,”bulletinFamily”:””,”cwe”:[“CWE-862″],”cvelist”:null,”sourceData”:”stellarwp The Events Calendar *”,”sourceHref”:””,”cvss”:{“score”:4.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”The Events Calendar”,”version”:”*”,”vendor”:”stellarwp”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ‘tec_qr_code_modal’ AJAX endpoint in all…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,123,12,21,13,7,11,5],"class_list":["post-24204","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-43","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n