CVE-2025-12408: 
WordPress vulnerability analysis and mitigation

CVE-2025-12408 is an Information Exposure vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress, classified under CWE-200. It affects all versions up to and including 7.2.2.2, allowing unauthenticated attackers to extract data from password-protected, private, or draft event locations via the get_location action. The vulnerability was disclosed on December 12, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient access control on the get_location AJAX action in em-actions.php, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin fails to restrict which event locations can be queried, allowing any unauthenticated HTTP request to retrieve location data that should be gated behind authentication or post-status checks (e.g., password-protected, private, or draft status). No authentication, special privileges, or user interaction is required to exploit this flaw — an attacker simply needs network access to the WordPress site. The patch was applied in the plugin's SVN repository at changeset 3392395 (WordPress Trac, Wordfence).

Successful exploitation allows unauthenticated remote attackers to read location data associated with event entries that site administrators have intentionally restricted — including password-protected, private, or draft locations. The confidentiality impact is limited to this specific data type; there is no integrity or availability impact. While the vulnerability does not enable code execution or lateral movement, it may expose sensitive organizational or personal location information that site owners intended to keep non-public (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-12408. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Events Manager plugin (versions ≤ 7.2.2.2) using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/events-manager/readme.txt.
2. Identify the vulnerable endpoint: The get_location action is handled via WordPress's AJAX mechanism, accessible at https://target.com/wp-admin/admin-ajax.php.
3. Craft the request: Send an unauthenticated HTTP POST request to the AJAX endpoint with the action parameter set to get_location and a target location ID (e.g., action=get_location&id=<location_post_id>).
4. Extract restricted data: The server returns location data for the specified post ID regardless of its publication status (private, password-protected, or draft), exposing information the site owner intended to restrict (Wordfence, WordPress Trac).

• Network: Repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with the parameter action=get_location and varying id values, particularly from a single IP or automated scanning tool.
• Logs: WordPress access logs showing high-frequency requests to admin-ajax.php with action=get_location from unauthenticated sessions (no valid nonce or session cookie); HTTP 200 responses to these requests indicating successful data retrieval.
• Logs: Requests enumerating sequential or random integer values in the id parameter, suggesting automated scraping of location post IDs.

Plugin users should update the Events Manager plugin to version 7.2.3 or later, which includes the fix applied in SVN changeset 3392395 to em-actions.php. The vendor released version 7.2.3 on December 8, 2025, prior to the CVE's formal publication. No configuration-based workaround is available; upgrading is the only remediation. Site administrators unable to update immediately should consider temporarily deactivating the plugin (WordPress Trac, Events Manager Blog).

Sucuri included CVE-2025-12408 in their December 2025 vulnerability patch roundup, noting it as one of several WordPress plugin issues addressed that month (Sucuri Blog). The vulnerability received standard coverage from automated security feeds and aggregators (Vulners, VulDB, CIRCL) but did not generate significant community discussion, consistent with its medium severity and limited exploitation potential.