CVE-2025-12898: 
WordPress vulnerability analysis and mitigation

CVE-2025-12898 is a missing authorization vulnerability in the Pretty Google Calendar plugin for WordPress that allows unauthenticated attackers to retrieve the Google API key configured in the plugin's settings. The flaw exists in all versions up to and including 2.0.0, affecting the pgcal_ajax_handler() function which lacks a proper capability check. It was published on December 20, 2025, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the pgcal_ajax_handler() AJAX function registered by the Pretty Google Calendar plugin. Because WordPress AJAX handlers are accessible to unauthenticated users by default unless explicitly restricted, any remote attacker can invoke this handler without authentication and receive the stored Google API key in the response. No special privileges, user interaction, or complex conditions are required for exploitation — only network access to the target WordPress site (Wordfence, ENISA EUVD).

Successful exploitation results in unauthorized disclosure of the Google API key stored in the plugin's settings, directly impacting confidentiality. An exposed API key can allow attackers to impersonate the affected application and access or abuse associated Google services (e.g., Google Calendar API), potentially incurring financial costs, accessing calendar data, or enabling further attacks against the organization's Google account. There is no direct integrity or availability impact on the WordPress site itself (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12898 as of the available data. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it trivially exploitable by any attacker who identifies a vulnerable site (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Pretty Google Calendar plugin (version ≤ 2.0.0) using tools like WPScan, Shodan, or by checking /wp-content/plugins/pretty-google-calendar/ for plugin presence.
2. Identify the vulnerable AJAX endpoint: The plugin registers an AJAX action accessible via WordPress's standard wp-admin/admin-ajax.php endpoint without authentication.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to https://target-site.com/wp-admin/admin-ajax.php with the body parameter action=pgcal_ajax_handler (or the specific action name registered by the plugin).
4. Retrieve the API key: The server responds with the Google API key stored in the plugin's settings, which the attacker can then use to access Google services associated with the victim's account (Wordfence, ENISA EUVD).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=pgcal_ajax_handler (or related action names) originating from unknown or suspicious IP addresses, especially without a preceding authenticated session.
• Logs: WordPress access logs showing repeated or automated requests to admin-ajax.php with the plugin's action parameter from a single IP or user agent; HTTP 200 responses to these unauthenticated requests.
• Google API: Unexpected API usage spikes or requests from unfamiliar IP addresses in the Google Cloud Console for the API key associated with the plugin.

Site administrators should immediately deactivate and remove the Pretty Google Calendar plugin (all versions ≤ 2.0.0) until a patched version is released. As an interim measure, revoke and regenerate the Google API key exposed through the plugin in the Google Cloud Console, and restrict the new key's usage to specific referrers or IP addresses. Monitor the WordPress Plugin Directory for an updated version that implements proper capability checks on the AJAX handler (Wordfence, WordPress Plugin Page).