CVE-2025-15043 — Missing Authorization in THE Events Calendar

CWE-862 — Missing Authorization4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 80.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Stellarwp THE Events Calendar
Timeline
PublishedJan 20

Description

The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-29f5-2fjm-2836: The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_↗2026-01-20
▶
CVEList
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control↗2026-01-20
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-15043 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-15043 — Missing Authorization | cvebase