Object Injection Vulnerability in Elbisnero WordPress Events Calendar Registration & Tickets
CVE-2025-47581

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WordPress Events Calendar Registration & Tickets
Vendor
CVE Published:
19 May 2025

What is CVE-2025-47581?

The Elbisnero WordPress Events Calendar Registration & Tickets plugin is affected by a vulnerability that allows for Object Injection due to improper handling of deserialization. This vulnerability can lead to unauthorized actions or potential exploitation by attackers who can send specially crafted requests. Users and administrators of this plugin version need to take immediate security precautions to avoid potential data compromises.

Affected Version(s)

WordPress Events Calendar Registration & Tickets <= 2.6.0

References

https://patchstack.com/database/wordpress/plugin/wpeventp...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds (Patchstack Alliance)
.
CVE-2025-47581 : Object Injection Vulnerability in Elbisnero WordPress Events Calendar Registration & Tickets