CVE-2025-69352: 
WordPress vulnerability analysis and mitigation

CVE-2025-69352 is a Missing Authorization (Broken Access Control) vulnerability in StellarWP's The Events Calendar WordPress plugin. It affects all versions through and including 6.15.12.2, and was reported by researcher Phat RiO on December 10, 2025, with public disclosure on January 6, 2026. The vulnerability was assigned a CVSS v3.1 base score of 5.4 (Medium) by Patchstack, the reporting CNA (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before executing certain privileged actions. An attacker with at least Subscriber-level access to a WordPress site can exploit incorrectly configured access control security levels to perform actions beyond their intended privilege scope. No public proof-of-concept exploit code has been identified, and specific technical details about the affected function or endpoint have not been publicly disclosed (Patchstack).

Successful exploitation allows a low-privileged authenticated user (Subscriber role or higher) to perform unauthorized actions on the affected WordPress site, resulting in limited integrity and availability impacts. According to the updated CVSS vector from Patchstack (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), there is no direct confidentiality impact, but attackers may be able to modify or disrupt event-related data managed by the plugin. The scope is limited to the affected WordPress installation and does not inherently enable lateral movement or remote code execution (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, though this specific issue is rated low priority with unlikely exploitation impact (Patchstack).

The vulnerability is patched in The Events Calendar version 6.15.13, released by StellarWP/Liquid Web. Site administrators should update the plugin to version 6.15.13 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level accounts on the WordPress site can reduce exposure (Patchstack).

Sucuri included this vulnerability in their January 2026 vulnerability patch roundup, highlighting it as part of broader WordPress plugin security updates for the month. No significant vendor statements beyond the Patchstack advisory or notable researcher commentary beyond the original reporter (Phat RiO) have been identified.