CVE-2025-69352

The Events Calendar plugin for WordPress contains a security flaw that allows users with at least Subscriber-level privileges to execute an unintended operation without proper authorization in versions prior to 6.15.12.2. This vulnerability stems from the absence of capability checks on a specific function, enabling attackers to bypass normal access controls. As a result, authenticated users can exploit this weakness to carry out unauthorized actions.

Based on public CVE data (MITRE/NVD).