CVE-2025-12175: 
WordPress vulnerability analysis and mitigation

CVE-2025-12175 is a Missing Authorization vulnerability in the The Events Calendar plugin for WordPress, affecting all versions up to and including 6.15.9. The flaw allows authenticated attackers with Subscriber-level access or above to view draft event names and generate or view QR codes via the unprotected tec_qr_code_modal AJAX endpoint. It was disclosed on October 31, 2025, with the fix released in version 6.15.10. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence, NVD).

The root cause is CWE-862 (Missing Authorization): the tec_qr_code_modal AJAX action handler in src/Events/QR/QR_Code.php performs a nonce check for CSRF protection but fails to verify whether the requesting user has the capability to edit or view the target post before processing the request. In the patched version (6.15.10), a current_user_can('edit_post', $post->ID) check was added to the render_modal() method to enforce proper authorization. An attacker only needs a valid WordPress account (Subscriber role or higher) and a valid nonce to call the endpoint with an arbitrary post_id, enabling them to retrieve draft event titles and generate QR codes for unpublished content (GitHub Source, WP Changeset).

Successful exploitation results in unauthorized disclosure of draft event names and the ability to generate or view QR codes for unpublished events, impacting confidentiality. There is no integrity or availability impact, and the scope is limited to information that site administrators intended to keep private until publication. The risk is relatively contained — lateral movement and system-level compromise are not possible through this vulnerability alone (Wordfence, NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated WordPress account, which limits the attacker pool but does not eliminate risk on sites with open registration (Wordfence).

1. Obtain a WordPress account: Register or log in to the target WordPress site with at least Subscriber-level access.
2. Obtain a valid nonce: Load any page on the site that includes the tec_qr_code_modal nonce, or retrieve it via a legitimate authenticated request to the WordPress admin area.
3. Identify target post IDs: Enumerate post IDs of draft events by iterating over common integer values (e.g., post_id=1, post_id=2, etc.).
4. Send crafted AJAX request: Submit an HTTP POST or GET request to wp-admin/admin-ajax.php with parameters action=tec_qr_code_modal, post_id=<target_id>, and _wpnonce=<valid_nonce>.
5. Extract information: Parse the response to obtain the draft event title and generated QR code image, which encodes the event's URL (GitHub Source, Wordfence).

• Network: Unusual authenticated HTTP requests to wp-admin/admin-ajax.php with action=tec_qr_code_modal from low-privileged user accounts (Subscriber role); sequential or rapid enumeration of post_id parameter values.
• Logs: WordPress access logs showing repeated calls to admin-ajax.php?action=tec_qr_code_modal from the same authenticated session or IP address across multiple post IDs.
• File System: Unexpected QR code image files (named qr_<post_id>_<size>.png) appearing in the /wp-content/uploads/tec-qr-codes/ directory for draft or unpublished events.

Site administrators should update The Events Calendar plugin to version 6.15.10 or later, which adds a current_user_can('edit_post', $post->ID) authorization check to the render_modal() AJAX handler. No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading the plugin. Sites with open user registration should treat this update as higher priority (WP Changeset, Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the period of October 27–November 2, 2025, noting it as a medium-severity issue. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified (Wordfence Blog).