CVE-2025-67592: 
WordPress vulnerability analysis and mitigation

CVE-2025-67592 is a Missing Authorization vulnerability in the My Calendar WordPress plugin by Joe Dolson, classified under CWE-862. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially modifying data they should not have access to. The vulnerability affects My Calendar versions up to and including 3.6.16. It was published on December 9, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where the plugin fails to properly verify that a requesting user has the appropriate permissions before performing certain actions. This falls under the OWASP category of Broken Access Control, where security levels are incorrectly configured, allowing lower-privileged authenticated users to perform operations reserved for higher-privileged roles. The attack vector is network-based, requires low privileges, low complexity, and no user interaction, making it straightforward to exploit once an attacker has any authenticated session on the WordPress site (Feedly, Patchstack).

Successful exploitation results in a limited integrity impact — authenticated low-privileged users can perform unauthorized actions within the My Calendar plugin, such as modifying calendar data or settings they should not have access to. There is no direct confidentiality or availability impact based on the CVSS scoring. The scope is unchanged, meaning the impact is confined to the vulnerable component itself and does not facilitate lateral movement or privilege escalation to the broader WordPress installation (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67592 as of the available data. The EPSS score is approximately 0.032%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated session with at least low-level privileges on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the My Calendar plugin (version ≤ 3.6.16) using tools like WPScan or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/my-calendar/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for any low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Probe My Calendar plugin endpoints or admin-ajax actions that lack proper capability checks, such as those handling calendar event creation, modification, or settings changes.
4. Send unauthorized request: Craft and send an HTTP POST request to the identified endpoint (e.g., wp-admin/admin-ajax.php with the relevant action parameter) while authenticated as a low-privileged user, bypassing the expected authorization check.
5. Achieve unauthorized modification: The server processes the request without validating the user's role, resulting in unauthorized modification of calendar data or plugin settings (Feedly, Patchstack).

• Logs: WordPress access logs showing authenticated low-privileged users (Subscriber, Contributor) making POST requests to wp-admin/admin-ajax.php with My Calendar-specific action parameters that are normally restricted to higher roles.
• Logs: Unexpected modifications to calendar events or plugin settings in the WordPress database (wp_options or My Calendar-specific tables) not attributable to authorized admin users.
• Network: Repeated or scripted requests to My Calendar plugin endpoints from the same authenticated session, potentially indicating automated exploitation attempts.

Users should update the My Calendar plugin to a version beyond 3.6.16 that addresses this authorization flaw — check the official WordPress plugin repository for the latest patched release. If an immediate update is not possible, consider restricting user registration on the WordPress site or limiting access to the site to trusted users only, reducing the pool of potential low-privileged attackers. Site administrators should also review user roles and ensure no unnecessary accounts with even low-level privileges exist (Patchstack).