Information Disclosure Vulnerability in The Events Calendar Plugin by Modern Tribe

CVE-2025-12192

What is CVE-2025-12192?

The Events Calendar plugin for WordPress contains a vulnerability that allows unauthenticated attackers to gain sensitive system information. This occurs because the sysinfo REST endpoint utilizes a loose comparison for the provided key against the stored opt-in key. If the setting to automatically share system information is enabled, attackers can exploit this flaw by submitting a boolean value, thus retrieving the entire system report. This results in significant security risks, particularly for users who have enabled this feature.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References