CVE-2025-15043: 
WordPress vulnerability analysis and mitigation

CVE-2025-15043 is a Missing Authorization vulnerability in The Events Calendar plugin for WordPress, affecting all versions up to and including 6.15.13. The flaw allows authenticated attackers with subscriber-level access or above to manipulate Custom Tables V1 database migration operations — including starting, canceling, or reverting migrations — and potentially drop custom database tables entirely via the revert action. It was published on January 20, 2026, with a CVSS v3.1 base score of 5.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of proper capability checks on three AJAX-accessible functions: start_migration, cancel_migration, and revert_migration within the plugin's Custom Tables V1 migration workflow. Any authenticated WordPress user with at minimum subscriber-level privileges can invoke these functions over the network without elevated permissions, triggering database schema changes or table drops. The attack requires no user interaction and has low attack complexity, making it straightforward to exploit once an attacker has any valid WordPress account (Wordfence, WordPress Changeset).

Successful exploitation can result in partial integrity and availability impacts on the affected WordPress site. An attacker can disrupt event data by manipulating database migration states or permanently destroy custom database tables via the revert action, leading to data loss and potential site unavailability. While there is no direct confidentiality impact (no data exfiltration), the ability to drop database tables could cause significant operational disruption to sites relying on The Events Calendar plugin for event management (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15043 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account (subscriber level or above), which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain a WordPress account: Register or obtain any low-privilege WordPress account (subscriber level or above) on a target site running The Events Calendar plugin version ≤ 6.15.13.
2. Authenticate: Log in to the WordPress site and obtain a valid authentication session (cookies or nonce).
3. Identify the vulnerable AJAX endpoint: Locate the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) used by the plugin for migration actions.
4. Craft a malicious request: Send an authenticated POST request to the AJAX endpoint invoking one of the vulnerable actions — start_migration, cancel_migration, or revert_migration — without any additional privilege validation being enforced.
5. Trigger table drop: Use the revert_migration action to drop the plugin's custom database tables, causing data loss and potential disruption to event management functionality on the site (Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with action parameters start_migration, cancel_migration, or revert_migration from low-privilege user accounts.
• Database: Unexpected absence or truncation of The Events Calendar custom database tables (e.g., tables prefixed with wp_tec_*); database error logs indicating dropped tables.
• Logs: WordPress debug logs or PHP error logs showing unexpected migration state changes or database schema modifications initiated outside of administrative sessions.

Users should update The Events Calendar plugin to version 6.15.13.1 or later, which introduces proper capability checks on the affected migration functions (WordPress Changeset). As a temporary workaround, site administrators can restrict user registration or limit subscriber-level account creation to reduce the attack surface. Additionally, web application firewalls (WAFs) such as Wordfence can be configured to block unauthorized access to the affected AJAX actions (Wordfence).

Sucuri included CVE-2025-15043 in their January 2026 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring attention (Sucuri Blog). The vulnerability received standard coverage from security aggregators and CVE tracking services, with no notable controversy or widespread community discussion beyond routine disclosure.