Unauthorized Data Modification in Private Google Calendars Plugin for WordPress

CVE-2025-12526

What is CVE-2025-12526?

The Private Google Calendars plugin for WordPress is susceptible to unauthorized data modifications due to a missing capability verification on the 'pgc_remove' action. This flaw affects all versions of the plugin up to and including version 20250811. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to reset critical settings of the plugin, potentially jeopardizing the integrity and functionality of users' calendar data.

References