{"basis":"claimed","id":"CVE-2025-9808","name":"The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure","vendorProject":"stellarwp","product":"The Events Calendar","publishedAt":"2025-09-16","cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"exploited":null,"epss":{"score":0.00826,"percentile":0.57451,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-09-16","daysToRule":365},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure","description":"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.","cwes":["CWE-200"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-09-16","firstIsNew":true,"daysToRule":365,"daysAtMost":null,"freePlan":false,"claims":[{"id":"005b343add53e03fdf87e96b82b32e0dac1a42ed07e64d275673d50dbe163a15","cve_id":"CVE-2025-9808","vendor":"f5","product":"Attack signatures","rule_id":"200009383","rule_name":"WordPress Events Calendar Information Leakage","change":"new","default_action":null,"published_on":"2026-09-16","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200009383 \"WordPress Events Calendar Information Leakage\" (Information Leakage, risk Low), systems: WordPress. References: CVE-2025-9808.","first_seen_at":"2026-11-02T21:00:24.151Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:35.125Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-9808","templatePath":"http/cves/2025/CVE-2025-9808.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/wp-json/tribe/events/v1/organizers","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/wp-json/tribe/events/v1/venues","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2025-9808","templatePath":"http/cves/2025/CVE-2025-9808.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/wp-json/tribe/events/v1/organizers","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/wp-json/tribe/events/v1/venues","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}