CVE-2025-69012

MediumCVSS 4.3

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Event Organiser WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.12.8.

Risk Assessment

An attacker may gain access to administrative functions without proper permissions, potentially leading to unauthorized changes to configuration or data.

Recommendation

Update the Event Organiser plugin to the latest available version that includes a fix for this vulnerability.

Other vulnerabilities in Event Organiser

CVE-2026-2387Medium
The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping.

Original NVD description (English source)

Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS