Information Exposure Vulnerability in Events Manager Plugin by WordPress

CVE-2025-12408

What is CVE-2025-12408?

The Events Manager plugin for WordPress is susceptible to an information exposure vulnerability that allows unauthenticated attackers to access sensitive data. This issue arises from inadequate restrictions in the 'get_location' action, enabling unauthorized users to extract information from password-protected, private, or draft event locations. As a result, crucial data that should remain confidential may inadvertently be exposed, emphasizing the need for urgent action to secure affected sites.

References