Unauthorized Data Access in Pretty Google Calendar Plugin for WordPress

CVE-2025-12898

What is CVE-2025-12898?

The Pretty Google Calendar plugin for WordPress exhibits a security vulnerability that allows unauthorized users to access sensitive data. Specifically, the pgcal_ajax_handler() function lacks an essential capability check, enabling unauthenticated attackers to retrieve the Google API key set within the plugin's configuration. This poses a significant risk, as the compromise of the API key can lead to further exploits and unauthorized actions within connected services.

References