CVE-2025-48246

The Events Calendar plugin for WordPress contains a security flaw that allows authorized users with elevated privileges to bypass normal access controls. Specifically, the ajax_preview_import function in versions 6.11.2.1 and earlier lacks sufficient permission checks, enabling attackers with subscriber-level clearance or higher to initiate an import without proper authorization.

Based on public CVE data (MITRE/NVD).