CVE-2025-12408

MEDIUM

The Events Manager - Calendar, Bookings, Tickets, and more! <7.2.2....

Title source: llm

Description

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset/3392395/events-manager/trunk/em-actions.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=cve

Scores

CVSS v3 5.3

EPSS 0.0031

EPSS Percentile 22.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (1)

netweblogic/Events Manager – Calendar, Bookings, Tickets, and more! < 7.2.2.2

Published Dec 12, 2025

Tracked Since Feb 18, 2026