Vulnerability DatabaseCVE-2025-2578

CVE-2025-2578:
WordPress vulnerability analysis and mitigation

Overview

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress contains a Full Path Disclosure vulnerability (CVE-2025-2578) affecting all versions up to and including 1.2.19. The vulnerability was discovered and disclosed on March 27, 2025 (Wordfence Intel).

Technical details

The vulnerability exists in the 'wpAmeliaApiCall' function and allows unauthenticated attackers to retrieve the full path of the web application. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD Database).

Impact

The vulnerability allows attackers to obtain the full path of the web application. However, the disclosed information is not useful on its own and requires another vulnerability to be present for any potential damage to the affected website (NVD Database).

Mitigation and workarounds

Website administrators should update the Amelia plugin to a version newer than 1.2.19 once available. The vulnerability has been identified and documented in the WordPress plugin repository (WordPress Plugin).