CVE-2025-69348: 
WordPress vulnerability analysis and mitigation

CVE-2025-69348 is a Missing Authorization (Broken Access Control) vulnerability in the CoolHappy "The Events Calendar Countdown Addon" WordPress plugin. It affects all versions up to and including 1.4.15, and was reported by researcher Legion Hunter on December 7, 2025, with public disclosure on January 6, 2026. The vulnerability allows authenticated users with low privileges (Subscriber level) to perform actions beyond their intended authorization. It carries a CVSS v3.1 base score of 4.3 (Medium), as assessed by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. This falls under OWASP Top 10 category A1: Broken Access Control. Exploitation requires a low-privilege authenticated account (e.g., a Subscriber-level WordPress user), and no user interaction beyond authentication is needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions on the affected WordPress site, resulting in a limited integrity impact (e.g., modifying plugin-related data or settings). There is no confidentiality or availability impact per the Patchstack CVSS assessment. The scope is limited to the affected plugin's functionality and does not directly enable remote code execution or lateral movement (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, though this specific issue is rated low priority with unlikely exploitation impact (Patchstack).

The vulnerability is patched in version 1.4.16 of The Events Calendar Countdown Addon. Site administrators should update the plugin to version 1.4.16 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Subscriber-level user registration or disabling the plugin temporarily are viable interim mitigations (Patchstack).